EUVD-2026-62843Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requires only low-privilege authentication; impact is limited to modifying own prior messages (I:L), with no confidentiality, availability, or scope impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. create_private_message checks the recipient's block list with PersonActions::read_block before inserting a message, while edit_private_message in crates/api/api_crud/src/private_message/update.rs only checks that the caller is orig_private_message.creator_id. The update then writes new content and returns the modified PrivateMessageView without consulting the recipient's block list, allowing a blocked sender to keep changing an old message that the recipient can still see and providing a post-block harassment path. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
AnalysisAI
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated Lemmy account (PR:L) and that the attacker have sent at least one private message to the target recipient before the block was applied - the attacker can only edit pre-existing messages, not create new ones post-block. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N) scores 5.3 Medium, accurately reflecting that exploitation requires authentication (PR:L) and produces only limited integrity impact (VI:L) with no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Lemmy user sends a private message to a target, who then blocks the sender. The now-blocked sender crafts a standard API edit request to the edit_private_message endpoint referencing the original message ID and supplies new harassing content; the endpoint accepts the update without consulting the block list, persists the modified text, and returns the updated PrivateMessageView - the victim sees the new content despite having blocked the sender. … |
| Remediation | Upgrade to Lemmy 0.19.19 (stable) available at https://github.com/LemmyNet/lemmy/releases/tag/0.19.19 or to 1.0.0-alpha.18 (development track) at https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.18; both releases include the fix from PRs #6472 and #6476 and commits 051b317c9d14b91972bb372c67f319d6900beb93 and 2d169d630b86b9351e4b1dca451214b741f46150. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given userna
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all I
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to f
Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigge
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today