CVSS 3.1 Score 6.5 of 10 (medium)


Published Jan 24, 2024
Updated: Feb 2, 2024
CWE ID 285
CWE ID 200


CVE-2024-23649 is a vulnerability found in Lemmy, a link aggregator and forum for the fediverse. Versions 0.17.0 to 0.19.1 are affected by this issue. The vulnerability allows users to report private messages, even if they are not the sender or recipient of the message. The API response to creating a private message report includes the private message itself, enabling any user to obtain all private messages on the instance by iterating over message ids. This poses a potential danger to organizations as sensitive information could be exposed. To remediate this vulnerability, the API method should be restricted to accessible recipients only, preventing unauthorized access to private messages.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-23649 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options