Lemmy EUVD-2026-62850

Exploitation requires that the target Lemmy instance is deployed using the bundled docker/nginx.conf or docker/federation/nginx.conf with the unpatched $proxy_add_x_forwarded_for directive - this is the default Docker deployment shipped with Lemmy. No authentication is required; the CVSS vector PR:N confirms unauthenticated exploitation. Affected endpoints are POST /api/v4/account/auth/register, POST /api/v4/account/auth/login, POST /api/v4/post, POST /api/v4/comment, GET /api/v4/search, POST /api/v4/image, and POST /api/v4/account/import_settings. Exploitation is limited to instances using the bundled nginx as the outermost proxy; deployments that place a trusted upstream proxy (CDN, load balancer) that strips or overwrites XFF headers before reaching nginx would not be directly exploitable via this vector. There is no required user interaction and no platform-specific constraint beyond the nginx configuration.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L (6.5 Medium) accurately reflects the attack surface: fully remote, no authentication, trivially low complexity. Real-world risk is meaningfully higher than the score alone suggests for the subset of operators using Lemmy's bundled Docker configuration, because all rate-limited API endpoints - registration, login, posting, commenting, search, image upload, and settings import - become simultaneously unprotected. A single attacker script can cycle through spoofed IPs and effectively eliminate all per-IP throttling. The EPSS score is not provided in the input data; given no KEV listing and no public POC, exploitation probability at the population level is likely low, but the attack is so mechanically simple that any motivated actor can replicate it without tooling. The integrity and availability impacts are understated by CVSS S:U: while scope does not change, a successful bypass can cause account-farm creation, spam flooding, and search-scraping that degrade service quality for legitimate users well beyond 'Low' practical impact. No signals conflict with each other; KEV status is absent and no POC is confirmed.

An attacker targeting a Lemmy instance running the default Docker deployment sends POST /api/v4/account/auth/register requests in a loop, each carrying a distinct spoofed first value in the X-Forwarded-For header (e.g., incrementing through 1.0.0.1, 1.0.0.2, …). Nginx appends the real IP but the rate limiter keys on the injected value, granting a fresh bucket for every request. This allows automated mass account creation or credential stuffing against the login endpoint at rates that bypass all configured throttles. No public POC is confirmed, but the technique requires only standard HTTP tooling.