PT-2026-136711

🗓️ 03 Nov 2026 00:00:00Reported by Positive TechnologiesType

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST crede...

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-121728	3 Nov 202615:17	–	circl
CVE	CVE-2026-121728	3 Nov 202622:55	–	cve
Cvelist	CVE-2026-121728 SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2	3 Nov 202622:55	–	cvelist
EUVD	EUVD-2026-116586	4 Nov 202600:32	–	euvd
NVD	CVE-2026-121728	3 Nov 202623:17	–	nvd
Rapid7 Vulnerability Database (full)	CVE-2026-121728: SourceHut meta.sr.ht: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated…	3 Nov 202600:00	–	rapid7

Source	Link
git	www.git.sr.ht/~sircmpwn/meta.sr.ht/refs/0.89.0
git	www.git.sr.ht/~sircmpwn/meta.sr.ht/commit/e471ffe75bb6ef11366e46c3b721dd0278f746b5
blog	www.blog.arusekk.pl/posts/srht-disabled-registration-bypass
git	www.git.sr.ht/~sircmpwn/meta.sr.ht/commit/1ea24685a76f6456245d0bc7fe6accf6231c4044
vulncheck	www.vulncheck.com/advisories/sourcehut-meta-sr-ht-0.56.11-before-0.89.0-registration-authorization-bypass-via-register-step2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-121728
git	www.git.sr.ht/~sircmpwn/meta.sr.ht/tree/0.88.9/item/metasrht/blueprints/auth.py

03 Nov 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 3.15.3

CVSS 46.9