CVE-2026-42180
Server-Side Request Forgery in Lemmy
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lemmy | lemmy | to 0.19.18 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Lemmy versions prior to 0.19.18. It allows an authenticated user with low privileges to create a link post in a public community. When such a post is created, the backend asynchronously sends a Webmention to the URL provided by the user. Although the URL is checked for syntax and scheme, the system does not block requests to loopback, private, or link-local addresses. This means a normal user can cause the server to make HTTP requests to internal services, potentially exposing internal network resources.
How can this vulnerability impact me? :
The vulnerability can be exploited by a low-privileged authenticated user to make the Lemmy server send HTTP requests to internal or private network services. This can lead to unauthorized access or interaction with internal systems that are normally protected from external access. Such server-side request forgery (SSRF) can be used to gather information about internal network infrastructure or potentially exploit other vulnerabilities within internal services.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been patched in Lemmy version 0.19.18. To mitigate this vulnerability, you should upgrade your Lemmy installation to version 0.19.18 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated low-privileged user to trigger server-side HTTP requests to internal services by exploiting the Webmention feature. This could potentially expose internal network resources or administrative endpoints.
However, there is no specific information in the provided context or resources about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an authenticated low-privileged user creating a link post that triggers server-side HTTP requests to internal or private network addresses via the POST /api/v3/post endpoint.
To detect exploitation attempts on your system or network, monitor HTTP POST requests to the /api/v3/post endpoint from authenticated users, especially those creating posts with URLs pointing to internal, loopback, or private IP address ranges.
Network monitoring tools or web server logs can be used to identify such requests. For example, you can use commands to search logs for POST requests to the vulnerable endpoint and analyze the URLs submitted.
- Using grep on web server logs to find POST requests to /api/v3/post: grep 'POST /api/v3/post' /var/log/nginx/access.log
- Extract URLs from the POST data and check if they point to internal IP ranges (e.g., 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12).
- Use network monitoring tools like tcpdump or Wireshark to capture outgoing HTTP requests from the Lemmy server to internal IP addresses, which may indicate exploitation attempts.
- Example tcpdump command to capture HTTP requests to private IP ranges: tcpdump -i eth0 'dst net 10.0.0.0/8 or dst net 192.168.0.0/16 or dst net 172.16.0.0/12'