Lemmy missing authorization in read_multi_community API

Executive brief

Lemmy is an open-source social media platform. A security issue in its development version allows unauthenticated visitors to view metadata from instances that have been specifically configured as private. This could lead to the exposure of community names, descriptions, and member lists that were intended to be restricted to authorized users only.

Technical details

A missing authorization check in the `read_multi_community()` function allows unauthenticated users to bypass the `private_instance` configuration. While other read handlers (such as those for posts, comments, and searches) correctly call `check_private_instance()`, this specific endpoint does not. An attacker can exploit this via a simple GET request to `/multi_community` to retrieve sensitive metadata including community names, titles, summaries, sidebars, owner identities, and member community lists. This vulnerability primarily affects development versions up to 0.19.1-rc.1.

Affected products

• LemmyNet lemmy_api <= 0.19.1-rc.1

Timeline

• 2026-04-29: disclosed: Vulnerability reported to LemmyNet
• 2026-05-06: advisory: GitHub Advisory published

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D