The vulnerability in homarr (CVE-2026-32602) involves a time-of-check to time-of-use (TOCTOU) race condition in the user registration endpoint (/api/trpc/user.register). The registration process performs three sequential database operations—CHECK, CREATE, and DELETE—without wrapping them in a transaction, allowing concurrent requests to bypass the single-use restriction on invite tokens. This enables an attacker to register multiple accounts using one invite token intended for single use. The vulnerability affects versions prior to 1.57.0 and is resolved in version 1.57.0.

An attacker can exploit this race condition to create multiple user accounts from a single-use invite token, potentially bypassing intended access controls. The impact is limited to low confidentiality and integrity loss, with no availability impact reported. The CVSS score is 4.2 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and limited impact on confidentiality and integrity.

Upgrade homarr to version 1.57.0 or later, where this race condition vulnerability is fixed. Since the fix involves making the registration process atomic, applying this official update fully mitigates the issue. Patch status is confirmed by the vendor's versioning information. No additional mitigations are indicated.