Technical impact
The race condition allows an attacker to create multiple user accounts using a single-use invite token by exploiting the lack of atomicity between the check, create, and delete database operations. This flaw can lead to an inflated user base, potential misuse of privileges associated with the token, and an elevated risk of unauthorized access or denial of service from an increased number of accounts.
Affected Systems
The vulnerability affects the Homarr dashboard from homarr-labs. Any deployment running a version earlier than 1.57.0 is susceptible. Homarr is an open-source web‑based interface for managing services; the registration endpoint in those affected versions can be abused through the race condition.
Risk and Exploitability
The CVSS score of 4.2 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of widespread exploitation. This issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation would require an attacker to obtain a valid invite token and submit multiple registration requests simultaneously or in rapid succession to bypass the single‑use check.
