2 results · Feed
-
Medium —
Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use
### Summary An improper uploaded media ownership check can result in inadvertent deletion of media when a user is banned with content removal or purged. This can lead to deletion of media that was not uploaded by the banned/purged user. This also applies to p…
-
High 7.5
Any authenticated user may obtain private message details from other users on the same instance
Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message re…