A logic bug in SourceHut's GraphQL API allows bypassing disabled registration. The bug was introduced in 2021 when registration code was migrated from the Flask/Jinja frontend to Go, where the 'registration closed' check was omitted from the success path of the form handler. Attackers can POST to /register/step2 to create accounts if SMTP is configured, though a CSRF token bypass is still required.
Background
SourceHut is a self-hosted Git and CI platform transitioning its architecture from Flask/Jinja to a Go-based GraphQL API. The migration in 2021 inadvertently introduced a logic bug in the registration flow.
- Source
- Lobsters
- Published
- Nov 6, 2026 at 02:34 AM
- Score
- 5.0 / 10