---
id: "CVE-2026-121728"
kind: "vulnerability"
aliases: ["CVE-2026-121728"]
title: "SourceHut meta.sr.ht: unauthenticated account registration when public signup is disabled"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["meta.sr.ht", "self-hosted", "sourcehut", "vendor"]
not_affected_if: ["managed-hosting", "public-registration-enabled"]
published_at: "2026-11-03T23:17:36+00:00"
first_seen_at: "2026-11-03T23:45:14+00:00"
updated_at: "2026-11-03T23:45:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121728", "first_seen_at": "2026-11-03T23:45:14+00:00"}]
---

# SourceHut meta.sr.ht: unauthenticated account registration when public signup is disabled

SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 skip the check that blocks new sign-ups when public registration is turned off. An unauthenticated attacker can create accounts by fetching a CSRF token from the login page and posting to the registration step, which calls an unchecked GraphQL mutation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running `meta.sr.ht` version and whether it is between `0.56.11` and `0.89.0`
- Check whether public registration is disabled on the instance and whether accounts were created that nobody authorized

## Fix

- Move to `0.89.0` or later, per the advisory's stated range

## Timeline

- 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121728

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2

## From the sources

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_