CVE-2026-54740
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.
Risk Assessment
An attacker can unauthorizedly remove moderators, potentially leading to community takeover and compromise of management integrity.
Recommendation
Upgrade Lemmy to version 0.19.19 or 1.0.0-alpha.18, which include the fix.
Other vulnerabilities in Lemmy
See all- CVE-2026-29178High
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs.
- CVE-2026-54743Medium
Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.
- CVE-2026-54741Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.
- CVE-2026-54739Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.
- CVE-2026-54738Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.
- CVE-2026-54742Medium
Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.
Original NVD description (English source)
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS