Security

Report a vulnerability

.github/SECURITY.md

Security Policy

Reporting a Vulnerability

Use Github's security advisory issue system.

Multi-community `Update` has no actor authorization
GHSA-5qxq-g3f3-57p5 published May 19, 2026 by Nutomic

Low
Private community profile and moderators leak via federation HTTP
GHSA-9wj2-3cv5-cqrx published May 18, 2026 by Nutomic

Moderate
Private community data exposed through community, saved, liked, and modlog API views
GHSA-95q8-x6r6-672m published Apr 29, 2026 by Nutomic

Moderate
Private Lemmy instances expose multi-community metadata without authentication
GHSA-jmxc-hhwx-gvv3 published Apr 29, 2026 by Nutomic

Moderate
Resend verification endpoint exposes registered email addresses
GHSA-qxrw-f6fh-34r7 published Apr 30, 2026 by Nutomic

Low
SSRF in /api/v3/post via Webmention dispatch
GHSA-3jvj-v6w2-h948 published Apr 20, 2026 by Nutomic

Moderate
SSRF and internal image disclosure in post link metadata via unvalidated og:image
GHSA-h6hf-9846-xwrq published Apr 20, 2026 by Nutomic

Moderate
Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests
GHSA-c482-7gjx-pp36 published Apr 13, 2026 by Nutomic

Low
SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()
GHSA-q537-8fr5-cw35 published Mar 23, 2026 by Nutomic

Moderate
Unauthenticated SSRF via file_type query parameter injection in image endpoint
GHSA-jvxv-2jjp-jxc3 published Mar 3, 2026 by Nutomic

Moderate

Learn more about advisories related to LemmyNet/lemmy in the GitHub Advisory Database