SourceHut Registration Bypass When Disabled (CVE-2026-121728)
Original title: SourceHut disabled registration bypass | CVE-2026-121728
A logic bug introduced in 2021 allows registration even when disabled in SourceHut versions 0.56.11-0.88.9 if SMTP is configured.
During a refactor of SourceHut's API to GraphQL, a subtle logic error in the registration handler allowed bypassing the disabled registration check on the happy path. Attackers can create accounts by posting to /register/step2, bypassing CSRF protections by using tokens from the login endpoint. The bug affects at least 10 instances.
- Affected versions: 0.56.11 through 0.88.9
- Fix landed after disclosure on 2026-11-03
- CVSS 4.0 subjective score
- Timeline starts from vulnerability introduced in 2021
Impact: Unauthorized account creation when registration is disabled
- 1.Update to the latest fixed version
- 2.Ensure SMTP is not configured if registration is disabled
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121728 | Authorization bypass in SourceHut meta.sr.ht before 0.89.0 | 6.9 | — |
From the original article
3 min read at blog.arusekk.plSo, last time I wrote about account takeover using XSS on the CI platform of SourceHut . This time I found something not nearly as ‘impactful’, but still interesting. Sorry for taking this long, but my SSD literally died 1 and while waiting for a warranty repair
By blog.arusekk.pl via mhm · blog.arusekk.pl
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.