SourceHut meta.sr.ht bypass lets attackers register accounts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
SourceHut meta.sr.ht from 0.56.11 before 0.89.0 contains a missing authorization check (CWE-862). An unauthenticated remote attacker can create accounts even when public registration is disabled. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
Upgrade SourceHut meta.sr.ht to 0.89.0, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA meta.sr.ht (SourceHut) Fixed in 0.89.0
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121728
- 2026-11-04 Alias added: GHSA-j8p6-f6h2-jc6f
- 2026-11-05 Priority changed: MEDIUM → LOW
References
Sources
- CVE-2026-121728 · CVE Program
- CVE-2026-121728 · NVD
- FIRST EPSS
- GHSA-j8p6-f6h2-jc6f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences