# Lemmy information disclosure in private community API views

Source: https://junglewise.ai/threats/lemmy-information-disclosure-in-private-community-api-views-57e7e4db  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-06. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.3 · Published 2026-05-06

Lemmy, a federated social media platform, contains a flaw where private community information is accidentally shared with unauthorized users. This allows unapproved or former members to view private community descriptions, sidebars, and saved posts that should be restricted. Additionally, public logs may reveal metadata about private communities to any visitor on the internet.

Technologies: [lemmy_api (crates.io)](https://junglewise.ai/threats/technologies/lemmy-api). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.3, published 6 May 2026.

**Which products and versions are affected?** lemmy_api (crates.io) <= 0.19.1-rc.1.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run lemmy_api (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An information disclosure vulnerability exists in Lemmy's API where several views fail to enforce the 'accepted follower' requirement for private communities. While PostView and CommentView correctly filter for private visibility, the CommunityView, PersonSavedCombinedQuery, PersonLikedCombinedQuery, and the modlog query (ListingType::All) lack these predicates. This allows unapproved registered users to read community sidebars/summaries, former members to access saved/liked private post bodies, and unauthenticated users to view private metadata via the modlog. The issue is present in the development/nightly versions up to 0.19.1-rc.1.

## Affected products

- LemmyNet lemmy_api <= 0.19.1-rc.1

## Timeline

- 2026-04-29: disclosed: Vulnerability published to LemmyNet/lemmy repository
- 2026-05-06: advisory: GitHub Advisory GHSA-95q8-x6r6-672m published

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users](https://junglewise.ai/threats/lemmy-resend-verification-endpoint-exposes-registered-email-addresses-3196db11)
- [Lemmy missing authorization in read_multi_community API](https://junglewise.ai/threats/lemmy-missing-authorization-in-read-multi-community-api-4056bf6e)