Executive brief
Private Lemmy instances expose multi-community metadata without authentication
Affected products
- crates.io lemmy_api
Junglewise Threat Intelligence
Private Lemmy instances expose multi-community metadata without authentication
Severity: low · CVSS 3.1 · Published 2026-05-06
Technologies: lemmy_api (crates.io). Vendors: crates.io.
Related threats
- Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users
- Lemmy information disclosure in private community API views
- Lemmy may expose private community data through community, saved, liked, and modlog API views
- Lemmy missing authorization in read_multi_community API