Any authenticated user may obtain private message details from other users on the same instance

CVE-2024-23649

What is CVE-2024-23649?

A significant vulnerability exists within the Lemmy link aggregator that allows users to report private messages without being the sender or recipient. This oversight exposes private message content to unauthorized users by including the private message in the API response when reports are created. As a result, any authenticated user can exploit this flaw to access sensitive information by iterating through message IDs. Additionally, users with instance administrator privileges may further exploit this situation, especially if private messages are filtered out in responses. To mitigate potential data exposure, users are urged to update to version 0.19.1 or implement alternate security measures such as blocking the API endpoint in reverse proxies until an update can be applied.

References