ETK-2026-1897Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1897",
  "cve_id": null,
  "display_id": "ETK-2026-1897",
  "ghsa_id": "GHSA-58m4-m8xj-v3j2",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unauthenticated resource exhaustion in HomeBox registration",
  "summary": "HomeBox container images before 0.27.0 have an unrate-limited, default-enabled user-registration endpoint. An unauthenticated remote attacker can repeatedly invoke registration to consume CPU and memory and add unwanted database records. Registration must be enabled for the endpoint to be exposed.",
  "mitigation": "Update HomeBox container images to version 0.27.0 or later. Disable public registration until the update is deployed if it is not required.",
  "vendor": "docker",
  "product": "docker:ghcr.io/sysadminsmedia/homebox",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.26.2"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.27.0"
      ],
      "package_name": "ghcr.io/sysadminsmedia/homebox",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 0.26.2"
      ],
      "ecosystem": "docker",
      "fixed_versions": [
        "0.27.0"
      ],
      "package_name": "sysadminsmedia/homebox",
      "purl": null
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 13.258987166666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-17T16:14:58+00:00",
      "days": -4.154318904722222,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T19:57:11.207318+00:00",
      "url": "https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-58m4-m8xj-v3j2"
    }
  }
}