3 results · Clear filters · Feed
-
Medium —
Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users
## Summary The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to `/api/v4/account/auth/resend_verification_email` and distinguish…
-
Medium 5.3
Lemmy may expose private community data through community, saved, liked, and modlog API views
**NOTE**: Only affects development version. ## Summary Lemmy applies private-community checks in `PostView` and `CommentView`, but several adjacent API views skip the accepted-follower filter. Bob, a registered user who is not an accepted follower, can read p…
-
Medium 5.3
Private Lemmy instances expose multi-community metadata without authentication
**NOTE**: Only affects development version. ## Summary `read_multi_community()` does not enforce the private-instance setting. On a private instance, an unauthenticated visitor can read multi-community names, titles, summaries, sidebars, owner identities, and…