Lemmy CVE-2026-54739

No special conditions are required beyond unauthenticated HTTP access to the Lemmy login endpoint, which is exposed by default on all public-facing Lemmy instances. No configuration change, privileged session, or specific deployment mode is needed. Exploitation is bounded by its impact: only account existence (username or email) is disclosed - no credentials, private messages, or account content are exposed. At scale, enumeration requires iterating many login requests, which instance operators may partially mitigate through rate-limiting, but the discriminating response discrepancy exists in all default configurations prior to the patch.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and score of 6.9 are well-calibrated: the flaw is network-exploitable with zero prerequisites but yields only low confidentiality impact limited to account existence. No EPSS data was provided and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. The practical risk is a force-multiplier for downstream attacks: confirmed account lists enable targeted credential stuffing, spear-phishing, or social engineering against Lemmy users, whose accounts are often pseudonymous and whose existence on a given instance may itself be sensitive. The risk is therefore moderate-to-low in isolation but meaningful in the context of Lemmy's user base, which often includes privacy-conscious individuals on politically or socially sensitive instances.

An unauthenticated attacker submits POST requests to the Lemmy login API with a list of candidate usernames or email addresses harvested from public Lemmy posts, profile pages, or data breaches, paired with a dummy password. By observing whether the response is HTTP 404 (account does not exist) or HTTP 400 (account exists, wrong password), the attacker builds a confirmed registry of active accounts on the target instance, which is then used to launch targeted phishing emails or automated credential-stuffing attacks against those confirmed users.