Live › vulnerability › CVE-2026-121728
SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 skip the check that blocks new sign-ups when public registration is turned off. An unauthenticated attacker can create accounts by fetching a CSRF token from the login page and posting to the registration step, which calls an unchecked GraphQL mutation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams that self-host meta.sr.ht, the SourceHut account and sign-in service, with public registration disabled. SourceHut's hosted service is the vendor's to patch; self-hosters must update themselves. Instances with public registration enabled are not affected by this bypass.
No product ranges from the sources yet.
meta.sr.ht version and whether it is between 0.56.11 and 0.89.00.89.0 or later, per the advisory's stated rangeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-121728")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.