Skip to content
OpenAdvisories

Vendor

LemmyNet

12 known vulnerabilities.

Products

lemmy 12
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.7
    CVE-2026-29178

    Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint

    Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint …

    LemmyNet lemmy lemmy_routes crates.io
  • High 7.5
    CVE-2024-23649

    Any authenticated user may obtain private message details from other users on the same instance

    Lemmy is a link aggregator and forum for the fediverse. Starting in version 0.17.0 and prior to version 0.19.1, users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message re…

    LemmyNet lemmy lemmy_server crates.io