CVE-2026-85287

HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An unauthenticated attacker who knows a victim's email can regist...

CVE-2026-85287

The home inventory system HomeBox is vulnerable to an email case-sensitivity bypass in versions prior to 0.27.0 . The POST /api/v1/users/register endpoint and the users.email uniqueness constraint treat email addresses as case-sensitive, whereas the login lookup process is case-insensitive. An un...