Threats tagged 'ghsa-j8p6-f6h2-jc6f'

SourceHut meta.sr.ht versions from 0.56.11 up to but not including 0.89.0 contain an authorization bypass vulnerability. This flaw allows unauthenticated attackers to register new accounts even when public registration is disabled by exploiting an unchecked GraphQL mutation. The attack involves obtaining a CSRF token from the login page and submitting credentials to the registration endpoint, bypassing intended access controls.