We know an issue occurred on the site over an hour ago with someone using my account to redirect the site, make fake posts, and change other settings. The problem has been corrected.

We will continue to monitor the situation and keep you informed.

  • @OnlycatsEnglish
    3•2 years ago

    It’s looks like an admin account got compromised.

    • AlmightySnoo 🐢🇮🇱🇺🇦English
      11•2 years ago

      Yes that’s what allowed them to modify the contents of the sidebar, but the more serious problem is that you can put HTML in the sidebar and it won’t be escaped by the Lemmy backend. That’s what allowed this JavaScript redirection.

      • deweydecibelEnglish
        9•2 years ago

        Should also be pointed out the admin is evidently still compromised. The one that posted this thread.

        • AlmightySnoo 🐢🇮🇱🇺🇦English
          4•2 years ago

          I’m opening Pandora’s box: what if all sidebars, not just the main one, have this vulnerability? An admin account being compromised will be the least of our worries if this is the case.