Executive brief
Lemmy, an open-source social federation platform, is vulnerable to a flaw where authenticated users can force the server to make requests to internal network addresses. By creating a post with a specially crafted link, an attacker can probe internal services or trigger actions on private administrative interfaces that are not normally accessible from the internet. This could lead to the exposure of sensitive internal data or unauthorized access to local infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Lemmy's Webmention implementation. When a user creates a link post via 'POST /api/v3/post' in a public community, the backend asynchronously dispatches a Webmention to the provided URL. While the application validates the URL scheme (allowing http, https, and magnet), it fails to check if the destination is a loopback, private, or link-local address. An authenticated attacker can exploit this to use the Lemmy server as a proxy to scan or interact with internal HTTP services. The issue is patched in version 0.19.18.
Affected products
- LemmyNet Lemmy < 0.19.18
Timeline
- 2026-04-20: disclosed
- 2026-04-24: advisory
- 2026-04-24: patched: Fixed in version 0.19.18