Security advisories

medium2026-05-06

Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

GHSA-qxrw-f6fh-34r7

medium2026-05-06

Lemmy may expose private community data through community, saved, liked, and modlog API views

GHSA-95q8-x6r6-672m

medium2026-05-06

Private Lemmy instances expose multi-community metadata without authentication

GHSA-jmxc-hhwx-gvv3

medium2026-04-24

Lemmy has SSRF in /api/v3/post via Webmention dispatch

GHSA-3jvj-v6w2-h948 · CVE-2026-42180

medium2026-04-24

Lemmy has SSRF and internal image disclosure in post link metadata via unvalidated og:image

GHSA-h6hf-9846-xwrq · CVE-2026-42181

high2026-03-04

Lemmy has unauthenticated SSRF via file_type query parameter injection in image endpoint

GHSA-jvxv-2jjp-jxc3 · CVE-2026-29178

medium2025-04-08

Lemmy user purging users or communities or banning users can delete images they didn't upload/exclusively use

GHSA-wr2m-38xh-rpc9

high2024-01-24

Any authenticated user may obtain private message details from other users on the same instance

GHSA-r64r-5h43-26qv · CVE-2024-23649