CVE-2026-121728 in meta.sr.ht
Summary
by MITRE • 11/04/2026
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The sourcehut meta.sr.ht platform version 0.56.11 prior to 0.89.0 suffers from a critical authorization bypass vulnerability that undermines the intended security controls for user registration. This flaw specifically targets environments where public account creation has been explicitly disabled by administrators, typically in private or enterprise deployments to restrict access to authorized personnel only. The vulnerability arises because the application fails to properly validate whether public registration is enabled before processing requests directed at specific internal endpoints used during the multi-step account creation process.
The technical mechanism of this exploit relies on a flawed separation between authentication and authorization logic within the web interface's backend services. An unauthenticated attacker can initiate the attack by requesting a Cross-Site Request Forgery token from the /login endpoint, which is publicly accessible regardless of registration settings. With this valid CSRF token in hand, the attacker proceeds to POST user credentials directly to the /register/step2 endpoint. This action triggers an underlying GraphQL mutation known as RegisterAccount, which was not adequately protected by access control checks that verify if public registration is permitted. Consequently, the system processes and accepts these inputs as legitimate attempts to create new accounts despite the global configuration prohibiting such actions.
The operational impact of this vulnerability allows unauthenticated actors to bypass administrative restrictions and establish valid user identities within the platform. This unauthorized account creation can lead to several severe security consequences including data leakage if sensitive information is accessible through newly created profiles, resource exhaustion due to the proliferation of fake accounts, and potential lateral movement if these new accounts are granted any level of access or trust by other system components. Furthermore it may facilitate further attacks such as phishing campaigns using legitimate-looking user identities within the organization's communication channels hosted on sourcehut services.
From a classification perspective this vulnerability aligns with CWE-287 Improper Authentication and CWE-352 Cross-Site Request Forgery since it involves bypassing authentication mechanisms via forged requests that exploit missing authorization checks. In terms of attack vectors it corresponds to MITRE ATT&CK technique T1098 which covers account manipulation specifically unauthorized creation or modification of accounts allowing attackers to establish persistence or escalate privileges within the affected environment.
To mitigate this risk organizations running sourcehut meta.sr.ht versions earlier than 0.89.0 should immediately upgrade to version 0.89.0 or later where these authorization checks have been properly implemented and validated against public registration settings. Until an upgrade is feasible administrators can implement temporary compensating controls such as restricting access to the /register/step2 endpoint at the web server level using IP whitelisting for known administrative ranges if applicable though this may not be practical in all cloud-based deployments. Additionally enabling comprehensive logging and monitoring for unusual spikes in registration attempts or requests targeting internal GraphQL mutations can help detect exploitation activities in real time allowing security teams to respond promptly before significant damage occurs.