CVE-2026-121728 — Vulnerability intelligence
—
Published:
- CVSS
- 6.9
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the unchecked GraphQL RegisterAccount mutation to create accounts.