CVE-2026-121728

EUVD-2026-116586
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/
https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044
https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5
https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0
https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121
https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2