Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Run SourceHut with registration closed? Since 2021, POST /register/step2 still created accounts if SMTP was set up: the handler only checked the setting on error paths. A CSRF token from /login works. Fixed Nov 3 (CVE-2026-121728). Check meta's /users for unknown accounts.