⌘ + K

CVE-2026-121728

Dashboard / Vulnerabilities / CVE-2026-121728

CVE-2026-121728

Published: 3 Nov 2026Last Modified: 5 Nov 2026

Summary: SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2

Details: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.

References: https://git.sr.ht/~sircmpwn/meta.sr.ht, https://git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121728.json, https://nvd.nist.gov/vuln/detail/CVE-2026-121728, https://www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2, https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5, https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044, https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py#L121, https://blog.arusekk.pl/posts/srht-disabled-registration-bypass/

Affected packages

Package

Name:

Purl:

Affected ranges

Type: GIT

Events:

Introduced- 1ea24685a76f6456245d0bc7fe6accf6231c4044

Fixed -e471ffe75bb6ef11366e46c3b721dd0278f746b5

Affected versions

0.88.9

0.88.8

0.88.7

0.88.6

0.88.5

0.88.4

0.88.3

0.88.2

0.88.1

0.88.0

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High