Lemmy

A federated, open-source link aggregator and discussion platform, similar to Reddit. Built on ActivityPub. Wide range of cross-platform client apps.

Open Source

Lemmy Source Code

Author

LemmyNet

Description

๐Ÿ€ A decentralised discussion platform for communities.

#activitypub#chat#fediverse#lemmy#link-aggregator#reddit#rust

Homepage

https://join-lemmy.org

License

AGPL-3.0

Created

14 Feb 19

Last Updated

20 Jul 26

Latest version

v0.17.3-rc.2

Primary Language

Rust

Size

39,629 KB

Stars

14,509

Forks

960

Watchers

14,509

Language Usage

Language Usage

Star History

Star History

Top Contributors

Recent Commits

  • Pavlos Smith (14 Jul 26)

    Add report resolve reason (#6612) * Added report resolve reason fields, work in progress * Report resolve reason works, federation and notification TODO * Removed TODO comments, fixed tests * sql format

  • Nutomic (14 Jul 26)

    Handle create post activity from Mitra (fixes #6577) (#6611)

  • Nutomic (10 Jul 26)

    Switch to jemalloc (#6608)

  • Nutomic (06 Jul 26)

    Change more activity types to accept both id or embed (fixes #2106) (#6600) * Change more activity types to accept both id or embed (fixes #2106) * clippy

  • Nutomic (06 Jul 26)

    Fix for accepting Mitra create activity (fixes #6577) (#6601)

  • Nutomic (03 Jul 26)

    Proper fix for accept activity with object id (fixes 6595) (#6599) * Proper fix for accept activity with object id (fixes #6595) * cleanup

  • Dessalines (03 Jul 26)

    Add typos check to CI. (#6560) * Add typos check to CI. * Move below prettier * Also exclude readmes * Running typos * A few more * No reason to use nightly rust image for typos.

  • Felix Ableitner (03 Jul 26)

    Version 1.0.0-beta.1

  • Nutomic (30 Jun 26)

    Fix private message sending from 0.19 to 1.0 (fixes #6591) (#6597)

  • Nutomic (29 Jun 26)

    Handle accept activity with object id (fixes 6595) (#6596)

  • Dessalines (23 Jun 26)

    Adding community moderators to GetPost (#6593) - Fixes #6592

  • Waqqas Sheikh (22 Jun 26)

    Update activity count of dead communities (fixes #5794) (#6589) The `community_aggregates_activity` function returns a mapping of community and activity count. A scheduled task updates the community record with the activity count. The query used in `community_aggregates_activity` mistakenly omits dead communities. This causes the recorded activity count to go stale which causes the issue. The fix is to add an update query at the end of the scheduled task that resets the activity count to 0 for those communities that were not returned by the query.

  • Waqqas Sheikh (16 Jun 26)

    Adds additional attachments to end of post (fixes #6229) (#6585) * Adds additional attachments to end of post (fixes #6229) When activities of posts have both an image and a link attachment, lemmy only takes the image attachment. The link attachment is dropped. The solution is to add the additional links at the end of the post body (similar to how multiple attachments are handled for comments) This fixes issue 6229. * Address lint issues (needless borrow) * Remove test comment that documents old behavior

  • Nutomic (16 Jun 26)

    Federate warnings (fixes #6326) (#6582) * Federate warnings (fixes #6326) * clippy * Apply suggestion from @dessalines Co-authored-by: Dessalines <[email protected]> * fixes --------- Co-authored-by: Dessalines <[email protected]>

  • Nutomic (09 Jun 26)

    Fix for private community accept federation (fixes #6576) (#6580) * Fix for private community accept federation (fixes #6576) * fmt

  • Nutomic (09 Jun 26)

    Remove duplicate schema entry (#6579)

  • Nutomic (09 Jun 26)

    Auto-approve private comm follows for admins/mods (#6578)

  • Dessalines (09 Jun 26)

    Add child_count to modlog, used for bulk_action_parents. (#6569) * Add child_count to modlog, used for bulk_action_parents. - Adds a child_count column to modlog, default 0. - Adds an SQL trigger, that increments the modlog child count for the parent. - Adds a few tests to make sure that inserted children are correctly incrementing this count. - Fixes #6563 * Remove child count default in form * Decrement child count on row delete

  • Nutomic (08 Jun 26)

    In nginx config use `$remote_addr` (#6575)

  • Dessalines (08 Jun 26)

    Include your own private messages when using creator_id filter. (#6572) - Fixes #6571

  • Nutomic (05 Jun 26)

    Feature flag for plugins (#6570) * Feature flag for plugins * error if plugins configured * clippy

  • Dessalines (04 Jun 26)

    Splitting out show_media and hide_posts_with_media user settings. (#6566) - Fixes #6564

  • Nutomic (04 Jun 26)

    Use correct Activitypub id for private community follow Accept/Reject (fixes #6561) (#6562) * Use correct Activitypub id for private community follow Accept/Reject (fixes #6561) * fmt * fix sql * add comment

  • Dessalines (04 Jun 26)

    Adding post filtering by tag. (#6567) * Filter post listing by tag (fixes #6505) * Fixing the tags filter * Update comment. * Fixing the tags filter (#6510) * Fixing the tags filter * Update comment. * test case * Adding post filtering by tag. - Fixes #6505 * Fixing import --------- Co-authored-by: Felix Ableitner <[email protected]>

  • Nutomic (02 Jun 26)

    Add missing permission checks for private community (fixes #6529) (#6559)

  • Nutomic (02 Jun 26)

    Federate private message reports (fixes #4436) (#6557) * Federate private message reports (fixes #4436) * also federate resolve * fix test

  • Nutomic (02 Jun 26)

    Remove wrong community title check (#6558)

  • Dessalines (02 Jun 26)

    Adding a few lemmy_api_common exports needed for lemmy-rs-client. (#6551) * Adding a few more API exports * Add post warning and post response * Adding create comment warning and lock * Version 1.0.0-alpha.20 * Try to fix cargo publish 1 * Comment out others temp * Version 1.0.0-test-fix-publish-1 * Version 1.0.0-test-fix-publish-2 * Version 1.0.0-test-fix-publish-3 * Revert "Comment out others temp" This reverts commit b731274485d277d32083ef5846c7e89768cefd89.

  • Nutomic (01 Jun 26)

    Prevent user enumeration via login endpoint (#6531) * Prevent user enumeration via login endpoint * clippy * change error * change dummy hash * spawn_blocking * clippy

  • Nutomic (01 Jun 26)

    Dont show community mods in pending follows list (fixes #6549) (#6556)

Lemmy Security

5.4/10

Repo Security Summary

Updated 29 Jun 26

  • Code-Review 10/10
  • Token-Permissions N/A
  • Dangerous-Workflow N/A
  • Packaging N/A
  • Maintained 10/10
  • Security-Policy 9/10
  • CII-Best-Practices 0/10
  • Binary-Artifacts 10/10
  • License 10/10
  • Fuzzing 0/10
  • Branch-Protection N/A
  • Signed-Releases 0/10
  • Pinned-Dependencies 0/10
  • SAST 0/10

Security Advisories (23)

  • medium Patched

    CVE-2026-54738 Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfo

  • low Patched

    CVE-2026-54743 Stored XSS via markdown image alt-text in lemmy-ui html5-embed

  • medium Patched

    CVE-2026-54739 Login Endpoint User Enumeration via HTTP Response Code Differential

  • low Patched

    GHSA-5qxq-g3f3-57p5 Multi-community `Update` has no actor authorization

  • low Patched

    GHSA-9wj2-3cv5-cqrx Private community profile and moderators leak via federation HTTP

  • low Unpatched

    CVE-2026-54742 `CollectionAdd::Featured` does not check the post is in the community

  • low Patched

    GHSA-95q8-x6r6-672m Private community data exposed through community, saved, liked, and modlog API views

  • low Patched

    CVE-2026-54741 Blocked users can edit private messages sent before the block

  • low Patched

    GHSA-jmxc-hhwx-gvv3 Private Lemmy instances expose multi-community metadata without authentication

  • medium Patched CVSS 6.5

    CVE-2026-54740 Lower-ranked federated moderator can remove higher-ranked moderators

  • low Patched

    GHSA-vh35-q865-92vr Federated Block activity can ban local users without site admin authorization

  • low Patched

    GHSA-qxrw-f6fh-34r7 Resend verification endpoint exposes registered email addresses

  • medium Unpatched CVSS 6.3

    CVE-2026-42180 SSRF in /api/v3/post via Webmention dispatch

  • medium Unpatched CVSS 6.5

    CVE-2026-42181 SSRF and internal image disclosure in post link metadata via unvalidated og:image

  • low Unpatched

    GHSA-c482-7gjx-pp36 Blind SSRF in /api/v3/resolve_object, normal user can reach internal services and make outbound requests

  • medium Patched CVSS 6.5

    CVE-2026-33693 SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid()

  • medium Patched

    CVE-2026-29178 Unauthenticated SSRF via file_type query parameter injection in image endpoint

  • low Patched

    GHSA-x57w-mr53-3f5h DB performance issues

  • medium Patched

    GHSA-373q-r73m-8mrg Local users can delete arbitrary entries from the local_image table

  • medium Patched

    GHSA-7xwp-jqhc-v6vw Local users can delete arbitrary pict-rs media

  • medium Patched

    GHSA-wr2m-38xh-rpc9 Purging users or communities or banning users can delete images they didn't upload/exclusively use

  • medium Unpatched CVSS 4

    CVE-2025-25194 Server-Side Request Forgery (SSRF) in activitypub_federation

  • high Patched CVSS 7.5

    CVE-2024-23649 Any authenticated user may obtain private message details from other users on the same instance

Lemmy Website

Website

Lemmy - A decentralised discussion platform for communities

Lemmy

Redirects

Does not redirect

Security Checks

All 65 security checks passed

Server Details

  • IP Address 65.21.61.25
  • Hostname static.25.61.21.65.clients.your-server.de
  • Location Helsinki, Uusimaa, Finland, EU
  • ISP Hetzner Online GmbH
  • ASN AS24940

Associated Countries

  • US US
  • FI FI

Safety Score

Website marked as safe

100%

Blacklist Check

join-lemmy.org was found on 0 blacklists

  • AntiSocial Blacklist
  • Artists Against 419
  • Badbitcoin
  • Bambenek Consulting
  • CERT Polska
  • CoinBlockerLists
  • CRDF
  • CryptoScamDB
  • EtherAddressLookup
  • EtherScamDB
  • Fake Website Buster
  • MetaMask EthPhishing
  • NABP Not Recommended Sites
  • OpenPhish
  • PetScams
  • PhishFeed
  • PhishFort
  • Phishing.Database
  • PhishStats
  • PhishTank
  • Phishunt
  • RPiList Not Serious
  • Scam.Directory
  • SecureReload Phishing List
  • Spam404
  • StopGunScams
  • Suspicious Hosting IP
  • ThreatFox
  • ThreatLog
  • TweetFeed
  • URLhaus
  • ViriBack C2 Tracker

Website Preview

Website preview

Lemmy Android App

APK Info

De-Googled Compatibility

Native 4.00 / 4 4 ratings
microG 4.00 / 4 3 ratings
  • GrapheneOS Native 4.0 / 4 (2)
  • LineageOS microG 4.0 / 4 (2)

Tested on Android 11โ€“16 ยท Updated 09 Oct 25 ยท View on Plexus โ†’

Trackers

No trackers found

Permissions

  • Access Network State
  • Internet
  • Read External Storage
  • Read Media Audio
  • Read Media Images
  • Read Media Video
  • Write External Storage
  • Dynamic Receiver Not Exported Permission

Lemmy Reviews

More Social Networks

About the Data: Lemmy

Change History

API

You can access Lemmy's data programmatically via our API. Simply make a GET request to:

https://api.awesome-privacy.xyz/v1/services/lemmy

The REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.

Share Lemmy

Help your friends compare Social Networks, and pick privacy-respecting software and services.
Share Lemmy and Awesome Privacy with your network!

View Social Networks (4)