Skip to main content

Lemmy CVE-2026-54739

| EUVDEUVD-2026-62847 MEDIUM
Observable Response Discrepancy (CWE-204)
2026-08-19 GitHub_M
Information Disclosure Lemmy
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-exposed login endpoint requires no auth or interaction; only account existence is disclosed, so C:L with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 19, 2026 - 21:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 21:11 vuln.today
Analysis Generated
Aug 19, 2026 - 21:11 vuln.today

DescriptionCVE.org

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

AnalysisAI

Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given username or email address is registered by observing differentiated HTTP status codes - HTTP 404 for nonexistent accounts versus HTTP 400 for existing accounts with a wrong password. All Lemmy instances prior to 0.19.19 (stable) and 1.0.0-beta.1 (beta) are affected across the full fediverse deployment surface. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send login requests with candidate usernames
Delivery
Observe HTTP 404 vs HTTP 400 response codes
Exploit
Confirm which accounts are registered
Execution
Build targeted account list
Impact
Launch credential stuffing or phishing campaign
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No special conditions are required beyond unauthenticated HTTP access to the Lemmy login endpoint, which is exposed by default on all public-facing Lemmy instances. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and score of 6.9 are well-calibrated: the flaw is network-exploitable with zero prerequisites but yields only low confidentiality impact limited to account existence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker submits POST requests to the Lemmy login API with a list of candidate usernames or email addresses harvested from public Lemmy posts, profile pages, or data breaches, paired with a dummy password. By observing whether the response is HTTP 404 (account does not exist) or HTTP 400 (account exists, wrong password), the attacker builds a confirmed registry of active accounts on the target instance, which is then used to launch targeted phishing emails or automated credential-stuffing attacks against those confirmed users.
Remediation Upgrade to Lemmy 0.19.19 (stable) or 1.0.0-beta.1 (beta), both available at https://github.com/LemmyNet/lemmy/releases/tag/0.19.19 and https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-beta.1 respectively, with release notes at https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Lemmy

View all
CVE-2026-42181 MEDIUM
6.5 May 08

Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass
CVE-2026-54738 MEDIUM
6.5 Aug 19

Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all I
CVE-2026-54740 MEDIUM
6.5 Aug 19

Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to f
CVE-2024-23649 MEDIUM
6.5 Jan 24

Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely
CVE-2026-54743 MEDIUM
6.4 Aug 19

Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated

CVE-2026-42180 MEDIUM
6.3 May 08

Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigge
CVE-2026-54741 MEDIUM
5.3 Aug 19

Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old

Same weakness CWE-204 – Observable Response Discrepancy

View all
CVE-2018-25350 CRITICAL POC
9.3
CVE-2024-28232 HIGH POC
7.5
CVE-2024-24766 HIGH POC
7.5
CVE-2026-54768 MEDIUM POC
6.9
CVE-2025-66307 MEDIUM POC
6.5
CVE-2024-6056 MEDIUM POC
6.3
CVE-2025-30150 MEDIUM POC
5.5
CVE-2024-55198 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-54739 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy