PT-2026-136711
CVE-2026-121728
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾