Threats affecting pkg:cargo/github/LemmyNet/lemmy

CVE-2026-54738 is a vulnerability in LemmyNet's lemmy software related to improper control of interaction frequency. It allows unauthenticated attackers to bypass rate limiting by spoofing the client IP address in the X-Forwarded-For header. This affects multiple API endpoints including account registration, login, posting, commenting, searching, image uploading, and account import. The issue is fixed in versions 0.19.19 and 1.0.0-beta.1.

CVE-2026-54742 is an authorization vulnerability in LemmyNet's lemmy software affecting versions prior to 0.19.19 and certain 1.0.0-alpha releases. It allows a community moderator to feature or unfeature posts in communities they do not moderate by exploiting insufficient verification of post ownership during federated CollectionAdd and CollectionRemove activities. This can lead to unauthorized modification of featured content across communities. The issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP ranges, the extracted og:image URL is not subject to the same restriction. As a result, an authenticated low-privileged user can submit an attacker-controlled public page whose Open Graph image points to an internal image endpoint. Lemmy will fetch that internal image server-side and store a local thumbnail that can then be served back to users. This issue has been patched in version 0.19.18.

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.7.0-beta.9, the `v4_is_invalid()` function in `activitypub-federation-rust` (`src/utils.rs`) does not check for `Ipv4Addr::UNSPECIFIED` (0.0.0.0). An unauthenticated attacker controlling a remote domain can point it to 0.0.0.0, bypass the SSRF protection introduced by the fix for CVE-2025-25194 (GHSA-7723-35v7-qcxw), and reach localhost services on the target server. Version 0.7.0-beta.9 patches the issue.

Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for ActivityPub federation in Rust. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs. This issue has been patched in version 0.19.16.