SourceHut disabled registration bypass | CVE-2026-121728
A SourceHut bug let people register on instances that had disabled registration: the hidden registration handler missed the closed-registration check on its success path. Email confirmation was still required.
The researcher reports affected versions 0.56.11 through 0.88.9 and says a fix landed November 3. Instance operators should update and check for unknown accounts; the write-up identifies /users as one place to look.