Any authenticated user may obtain private message details from other users on the same instance
github.com
### Summary Users can report private messages, even when they're neither sender nor recipient of the message. The API response to creating a private message report contains the private message it...

The full description of the bug is in the linked issue above, but the short version is:

Our CreatePrivateMessageReport endpoint had a bug that would allow anyone, not just the recipient, to create a report, and then receive the details about private messages.

This allowed anyone to iterate over ids, creating thousands of reports in order to receive details about private messages.

Since those reports are visible to admins, it would be easy to discover if someone was abusing this, and luckily we haven’t heard of anyone doing so on production instances (so far).

If you haven’t, please be sure to upgrade to at least 0.19.1 for the fix.

Many thanks to @Nothing4You for finding this one.

    • Dessalines@lemmy.mlOPMEnglish
      42·
      10 months ago

      Timing on publishing these is tricky. We let most server runners know about this ~a month ago now, and we’re now 2 versions past the bug.

      • Blaze@discuss.onlineEnglish
        137·
        10 months ago

        19.0 and 19.1 broke federation.

        19.2 restored federation.

        19.3, released this week, fixed an authentication issue.

        Seems you are either non-functional or insecure

        • Dessalines@lemmy.mlOPMEnglish
          18·
          10 months ago

          Those didn’t completely break federation, they just had some issues with a few services besides lemmy. They’re addressed now, but federation compatibility will always be an ongoing task as new services get added and existing ones change their activitypub responses.