cyfenced.com →

[ CVE-2026-121728 · Published 3 Nov 2026 ]

Vulnerability in SourceHut meta.sr.ht

CVSS 5.3 EPSS <1%No fix listed yet

[ Description ]Official description

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References