SourceHut meta.sr.ht CVE-2026-121728

The decisive precondition is that the instance must have public registration DISABLED - that is the exact control this flaw bypasses; on instances with open registration the bug grants nothing new. The target must run an affected meta.sr.ht version (0.56.11 up to but not including 0.89.0) with the /register/step2 endpoint and the RegisterAccount GraphQL mutation reachable over the network. No authentication is required (PR:N) and no user interaction is needed (UI:N); the attacker only needs to obtain a CSRF token from /login first. The main limiting factors are the narrow impact (only unauthorized account creation, VI:L, with no confidentiality or availability effect) and that the instance must be network-reachable by the attacker.

This is a genuine but bounded-impact authorization-bypass flaw, not a critical emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it is remotely reachable over the network, needs no special attack requirements, and requires no privileges or user interaction - so an unauthenticated remote attacker can trigger it against an exposed instance. However, the impact is deliberately scored narrow: VI:L with VC:N and VA:N, meaning only limited integrity impact (unauthorized account creation) and no confidentiality or availability loss, which is why the base score lands at 6.9 (medium). No EPSS score was provided, so exploitation probability cannot be quantified, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. A public write-up describing the exact bypass technique exists (the arusekk.pl blog), and the fix commits are public, which lowers the barrier to reproduction. The vuln.today decision label is 'this_month', consistent with a real-but-not-urgent priority: worth patching on a normal cycle rather than as an emergency. The key limiting signal is that this only matters where public registration has been intentionally disabled - on instances that allow open registration the bypass grants nothing the attacker could not already do.

An operator runs a private SourceHut instance with public registration disabled to keep it invite-only. A remote unauthenticated attacker fetches a CSRF token from /login and POSTs credentials directly to /register/step2, which calls the unchecked RegisterAccount GraphQL mutation and creates an account despite registration being off. The attack technique is publicly documented in a referenced blog post, so reproduction is straightforward.