{"apiVersion":"1.0","identifier":"CVE-2026-54738","description":"Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-beta.1, actix-web ConnectionInfo::realip_remote_addr reads the first value of X-Forwarded-For as the client address used by raw_ip_key in crates/utils/src/rate_limit/mod.rs. Lemmy-s bundled docker/nginx.conf uses $proxy_add_x_forwarded_for instead of $remote_addr, which appends the real client address to an X-Forwarded-For value supplied by the client. An unauthenticated attacker can therefore place a different spoofed address first on each request and receive a new rate-limit bucket, bypassing limits on POST /api/v4/account/auth/register, POST /api/v4/account/auth/login, POST /api/v4/post, POST /api/v4/comment, GET /api/v4/search, POST /api/v4/image, and POST /api/v4/account/import_settings. This permits excessive account creation, brute-force attempts, spam, scraping, uploads, and repeated imports. This issue is fixed in versions 0.19.19 and 1.0.0-beta.1.","publishedAt":"2026-08-19T21:16:58","lastModifiedAt":"2026-08-21T22:16:40","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54738","cvssScore":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","epssProbability":0.00428,"riskScore":0.68,"affectedProduct":"Lemmy","affectedVersions":"<0.19.19, <1.0.0-beta.1","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-54738","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-54738","en":"https://www.redsauce.net/en/cves/CVE-2026-54738","fr":"https://www.redsauce.net/fr/cves/CVE-2026-54738","pt":"https://www.redsauce.net/pt/cves/CVE-2026-54738","de":"https://www.redsauce.net/de/cves/CVE-2026-54738","sk":"https://www.redsauce.net/sk/cves/CVE-2026-54738","el":"https://www.redsauce.net/el/cves/CVE-2026-54738"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-54738"}}