Lemmy: Login Endpoint User Enumeration via HTTP Response Code Differential
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-204.
Summary
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, Lemmy's login endpoint in crates/api/api/src/local_user/login.rs returns different errors depending on whether the username_or_email value exists. LocalUserView::find_by_email_or_name propagates a NotFound response for an unknown account, while an existing account with a wrong password returns LemmyErrorType::IncorrectLogin. This observable response discrepancy, including HTTP 404 for a nonexistent account and HTTP 400 for an incorrect password on an existing account, allows an unauthenticated attacker to confirm registered usernames or email addresses and use the results for targeted credential attacks or social engineering. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA lemmy (LemmyNet) Fixed in 0.19.19, 1.0.0-beta.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54739
References
Other 8
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xgg7-8hvq-8m65
- https://github.com/LemmyNet/lemmy/pull/6531
- https://github.com/LemmyNet/lemmy/pull/6535
- https://github.com/LemmyNet/lemmy/commit/4d235a1b668b7dda6b73dbbc9ca289bb40acfa83
- https://github.com/LemmyNet/lemmy/commit/59e968a5ac36d36d08a59028e2dbb92641536964
- https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
- https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-beta.1
- https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
More LemmyNet vulnerabilities
- TI-2026-23295 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint CVSS 4.0HIGH 7.7
- TI-2026-26073 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() CVSS 3.1MEDIUM 6.5
- TI-2026-39555 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed CVSS 4.0MEDIUM 6.4
- TI-2026-39552 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators CVSS 3.1MEDIUM 6.5
- TI-2026-30504 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image CVSS 3.1MEDIUM 6.5
- TI-2026-39553 Lemmy: Blocked users can edit private messages sent before the block CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences