Lemmy
Monthly
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated actions against viewers who render attacker-controlled markdown content. The vulnerable markdown-it-html5-embed@1.0.0 plugin generates video element fallback HTML by inserting image alt text via unescaped string replacement, bypassing the markdown-it html:false safety setting because plugin-generated output is never subject to that guard. An attacker controlling a federated Lemmy instance or holding approved-member status can store the payload, and any viewer who renders it on a deployment lacking Content-Security-Policy headers will execute attacker JavaScript in the lemmy-ui origin. No public exploit identified at time of analysis; EPSS data not provided in source intelligence.
Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given username or email address is registered by observing differentiated HTTP status codes - HTTP 404 for nonexistent accounts versus HTTP 400 for existing accounts with a wrong password. All Lemmy instances prior to 0.19.19 (stable) and 1.0.0-beta.1 (beta) are affected across the full fediverse deployment surface. No public exploit has been identified at time of analysis, but the flaw requires no authentication or special configuration and is trivially exploitable with any HTTP client.
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. An authenticated moderator on any federated remote instance can therefore subvert community governance on the victim instance without the local API's protections. No public exploit code has been identified at time of analysis, and patches are available in both stable and alpha release lines.
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. An authenticated attacker who has been blocked by a recipient can repeatedly call the edit endpoint on any previously sent message, delivering new content and providing a post-block harassment channel - defeating the intent of Lemmy's block feature. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigger arbitrary HTTP requests to internal services by creating link posts with URLs targeting loopback, private, or link-local addresses. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled URL without validating against internal address ranges, enabling reconnaissance or exploitation of internal services. No public exploit code has been identified at time of analysis, but the vulnerability is straightforward to demonstrate and requires only user-level account access.
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass internal IP range restrictions and access internal image endpoints. An attacker can submit a crafted post whose Open Graph image tag points to an internal server; Lemmy will fetch and cache the image server-side, potentially exposing sensitive internal resources. The vulnerability exists because the initial page URL is validated against internal IP ranges, but the extracted og:image URL is not subject to the same restriction, creating a two-stage bypass.
Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all IP-based throttling by injecting a spoofed address as the first value of the X-Forwarded-For header. Because the bundled docker/nginx.conf forwards XFF headers using $proxy_add_x_forwarded_for rather than $remote_addr, attackers control the address that actix-web's ConnectionInfo::realip_remote_addr reads, receiving a fresh rate-limit bucket per request. No public exploit or CISA KEV listing exists, but exploitation is trivially automated and directly enables account registration spam, credential brute-forcing, comment spam, content scraping, bulk uploads, and repeated settings imports.
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated actions against viewers who render attacker-controlled markdown content. The vulnerable markdown-it-html5-embed@1.0.0 plugin generates video element fallback HTML by inserting image alt text via unescaped string replacement, bypassing the markdown-it html:false safety setting because plugin-generated output is never subject to that guard. An attacker controlling a federated Lemmy instance or holding approved-member status can store the payload, and any viewer who renders it on a deployment lacking Content-Security-Policy headers will execute attacker JavaScript in the lemmy-ui origin. No public exploit identified at time of analysis; EPSS data not provided in source intelligence.
Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given username or email address is registered by observing differentiated HTTP status codes - HTTP 404 for nonexistent accounts versus HTTP 400 for existing accounts with a wrong password. All Lemmy instances prior to 0.19.19 (stable) and 1.0.0-beta.1 (beta) are affected across the full fediverse deployment surface. No public exploit has been identified at time of analysis, but the flaw requires no authentication or special configuration and is trivially exploitable with any HTTP client.
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. An authenticated moderator on any federated remote instance can therefore subvert community governance on the victim instance without the local API's protections. No public exploit code has been identified at time of analysis, and patches are available in both stable and alpha release lines.
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old messages visible to the recipient. All Lemmy instances running versions prior to 0.19.19 (stable) and 1.0.0-alpha.18 (alpha) are affected. An authenticated attacker who has been blocked by a recipient can repeatedly call the edit endpoint on any previously sent message, delivering new content and providing a post-block harassment channel - defeating the intent of Lemmy's block feature. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigger arbitrary HTTP requests to internal services by creating link posts with URLs targeting loopback, private, or link-local addresses. When a post is created in a public community, the backend asynchronously sends a Webmention to the attacker-controlled URL without validating against internal address ranges, enabling reconnaissance or exploitation of internal services. No public exploit code has been identified at time of analysis, but the vulnerability is straightforward to demonstrate and requires only user-level account access.
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass internal IP range restrictions and access internal image endpoints. An attacker can submit a crafted post whose Open Graph image tag points to an internal server; Lemmy will fetch and cache the image server-side, potentially exposing sensitive internal resources. The vulnerability exists because the initial page URL is validated against internal IP ranges, but the extracted og:image URL is not subject to the same restriction, creating a two-stage bypass.
Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.