LemmyNet's lemmy software versions before 0.7.0-beta.9 contain an SSRF vulnerability (CWE-918) due to incomplete validation in the v4_is_invalid() function, which fails to reject the IPv4 unspecified address 0.0.0.0. An attacker controlling a remote domain can exploit this to bypass prior SSRF protections and reach internal localhost services on the server. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. The issue was addressed in version 0.7.0-beta.9.

An unauthenticated attacker can exploit this SSRF vulnerability to send requests from the vulnerable Lemmy server to internal localhost services that are normally inaccessible externally. This could lead to unauthorized information disclosure or manipulation of internal services, impacting confidentiality and integrity. There is no indication of availability impact or known exploits in the wild at this time.

Upgrade Lemmy to version 0.7.0-beta.9 or later, where the vulnerability is patched. Since this is not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified or required beyond applying the official fix.