Lemmy permits an authenticated low‑privileged user to create a link post through the public API endpoint, which then triggers an asynchronous Webmention to the supplied URL. The code validates only the syntax and scheme of the URL but does not reject loopback, private, or link‑local addresses; as a result, the server can issue HTTP requests to internal services. This unintended SSRF is identified by CWE‑918 and could allow an attacker to probe or exfiltrate sensitive information from the Lemmy host.

The vulnerability exists in Lemmy community software from LemmyNet:lemmy for all releases older than version 0.19.18. Users of any public community running an affected build may fall victim.

The CVSS score of 6.3 indicates a moderate severity; the EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only an authenticated normal user account, making the attack vector relatively low‑cost. The SVR process is fully automated, so once a post is accepted, the server will contact the attacker‑provided URL, enabling access to internal resources without additional privileges. Because of the authentication requirement, the risk is mitigated compared to blind SSRF but remains significant for organizations with internal services exposed on the Lemmy host.