Lemmy information disclosure in private community API views

Executive brief

Lemmy, a federated social media platform, contains a flaw where private community information is accidentally shared with unauthorized users. This allows unapproved or former members to view private community descriptions, sidebars, and saved posts that should be restricted. Additionally, public logs may reveal metadata about private communities to any visitor on the internet.

Technical details

An information disclosure vulnerability exists in Lemmy's API where several views fail to enforce the 'accepted follower' requirement for private communities. While PostView and CommentView correctly filter for private visibility, the CommunityView, PersonSavedCombinedQuery, PersonLikedCombinedQuery, and the modlog query (ListingType::All) lack these predicates. This allows unapproved registered users to read community sidebars/summaries, former members to access saved/liked private post bodies, and unauthenticated users to view private metadata via the modlog. The issue is present in the development/nightly versions up to 0.19.1-rc.1.

Affected products

• LemmyNet lemmy_api <= 0.19.1-rc.1

Timeline

• 2026-04-29: disclosed: Vulnerability published to LemmyNet/lemmy repository
• 2026-05-06: advisory: GitHub Advisory GHSA-95q8-x6r6-672m published

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D