GHSA-jmxc-hhwx-gvv3: Private Lemmy instances expose multi-community metadata without authentication

read_multi_community() does not enforce the private-instance setting. On a private instance, an unauthenticated visitor can read multi-community names, titles, summaries, sidebars, owner identities, and member community lists.

mid = api(“POST”, “/multi_community”, admin, json={ “name”: “m” + suffix, “title”: secret, “summary”: secret + " summary", “sidebar”: secret + " sidebar", }).json()[“multi_community_view”][“multi”][“id”]