Incorrect Ownership Assignment Affecting lemmy_server package, versions >=0.17.0 <0.19.11
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-LEMMYSERVER-9749470
- published18 Apr 2025
- disclosed8 Apr 2025
- creditUnknown
Introduced: 8 Apr 2025
New CVE NOT AVAILABLE CWE-708 (opens in a new tab)Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade lemmy_server to version 0.19.11 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Ownership Assignment when selecting files for deletion as part of a user or community purge or a user ban operation. An attacker can cause the deletion of image/* content-type images belonging to users other than the ones being banned or purged. This is only exploitable without authentication if the instance has open federation. Otherwise user interaction or a privileged attacker would be needed to exploit the vulnerability.