On 2026-04-26 a critical bug was registered to show that anybody could create a user account even if the administrator of a WriteFreely instance disallowed the registration of user accounts. The person who logged the bug added this information:

PS: not sure if it's actually a security issue, but we tried to reach out to security@writefreely.org beforehand, but haven't received a reply

The fix was merged into code two weeks ago.

The release to fix the problem was published ten hours ago. At the same time, WriteFreely posted this on Mastodon:

Most importantly, this fixes an issue where malicious actors can create accounts on closed-registration #WriteFreely instances running the previous v0.16 or below. We've heard reports of this ACTIVELY being exploited today across many WriteFreely instances — multi- and single-user. We advise ALL WriteFreely admins to upgrade immediately. You may also notice many unwanted accounts on your instance that need to be manually cleaned up. We'll be adding admin tools to make this quicker soon.

Two days ago, a person commented on the bug fix. The person made some points:

[...]

Today, I discovered more than 150 automatically created accounts on my instance, which was configured with registrations closed and invitations restricted to administrators. Each account immediately published a spam post.

We are talking about a complete bypass of the registration access control, which allows attackers to:

• Create unlimited accounts without authorization.
• Publish spam or malicious content under the instance’s domain.
• Consume storage and server resources.
• Damage the domain’s reputation.
• Potentially access private content on instances where authenticated users have additional permissions.

This issue was reported months ago and acknowledged as unintended behavior:

“This isn't by design, and did need to be fixed.”

However, it was deferred to a future release, without publishing a security update, notifying administrators, or providing an official mitigation. In the meantime, the vulnerable endpoint is actively being exploited.

A vulnerability of this severity should not have to wait for the next regular release. A corrective version, even if it is simply 0.16.1, should be released immediately, together with a security advisory warning all WriteFreely administrators.

[...]

Please release a security update immediately and clearly notify administrators. It is not acceptable to leave a publicly exploitable endpoint available for months when it completely invalidates the closed-registration setting.

I just had to manually connect to my instance and use mysql commands to manually delete a number of users.

Don't get me wrong: I'm grateful to use WriteFreely and I'm grateful to its makers. However, the critique should be taken seriously. WriteFreely does generate money for its maker. To wait nearly three months to fix what WriteFreely themselves seem to infer to as a 'critical security fix' is extremely bad. I'm considering to migrate from WriteFreely to a static site generator, for example, Mataroa, where I host another blog.