Authorization Bypass in SourceHut Meta Product by SirCmpwn
CVE-2026-121728

6.9MEDIUM

Key Information:

Vendor

Sourcehut

Status
Meta.sr.ht
Vendor
CVE Published:
3 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-121728?

The SourceHut meta.sr.ht application versions prior to 0.89.0 are prone to an authorization bypass vulnerability. When public registration is disabled, attackers can still create accounts by leveraging the /login endpoint to obtain a CSRF token. They can then exploit the unchecked GraphQL RegisterAccount mutation via the /register/step2 endpoint, allowing unauthenticated individuals to circumvent the registration restrictions and create accounts maliciously. This vulnerability poses significant security risks to user data and application integrity.

Affected Version(s)

meta.sr.ht 0.56.11 < 0.89.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-121728 - Proof of Concept

References

https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb...
patch
https://git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76...
technical-description
https://git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/m...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arkadiusz Kozdra
.