CVE-2026-42180

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs.

Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.

Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.

Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.

Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.

Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. The extracted og:image URL is not checked against internal IP ranges, so an authenticated low-privileged user can force server-side fetching of an internal image and store it as a local thumbnail.