An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for case-insensitivity during self-registration home directory ownership checks. Consequently, two users registering with names that differ only by case (e.g., `CaseVictim` and `casevictim`) are treated as distinct accounts but are mapped to the same physical home directory. This occurs because the scope-ownership check performs an exact case-sensitive string comparison. An attacker can register a similar username to read, overwrite, or delete files belonging to another account via authenticated HTTP endpoints without requiring victim interaction.