CVE-2026-54741
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 does not check the block list when editing private messages. A blocked sender can still edit old messages that the recipient can see, enabling post-block harassment.
Risk Assessment
A blocked user can continue sending unwanted content to the recipient, violating privacy and potentially leading to harassment.
Recommendation
Upgrade Lemmy to version 0.19.19 or 1.0.0-alpha.18, which include the fix.
Other vulnerabilities in Lemmy
See all- CVE-2026-29178High
Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation. Prior to version 0.19.16, the GET /api/v4/image/{filename} endpoint is vulnerable to unauthenticated SSRF through parameter injection in the file_type query parameter. An attacker can inject arbitrary query parameters into the internal request to pict-rs, including the proxy parameter which causes pict-rs to fetch arbitrary URLs.
- CVE-2026-54743Medium
Lemmy-ui before version 0.19.19-beta.1 renders Markdown without sanitization, allowing HTML injection and JavaScript execution in the lemmy-ui origin. An approved member or a remote federated instance can store malicious content, and a viewer who renders it may execute script, potentially exposing the viewer's session and authenticated actions.
- CVE-2026-54740Medium
Lemmy before versions 0.19.19 and 1.0.0-alpha.18 allows a lower-ranked moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The verification does not check moderator rank, enabling a junior moderator to strip senior moderators from the community moderator list.
- CVE-2026-54739Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 returns different errors during login depending on whether the username or email exists. A nonexistent account returns 404, while an existing account with a wrong password returns 400. This discrepancy allows an unauthenticated attacker to confirm registered usernames or email addresses.
- CVE-2026-54738Medium
Lemmy before versions 0.19.19 and 1.0.0-beta.1 uses the first X-Forwarded-For value as the client address for rate limiting. The bundled nginx config appends the real client address to a client-supplied value, allowing an attacker to spoof the address and bypass limits on multiple API endpoints.
- CVE-2026-54742Medium
Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.
Original NVD description (English source)
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. create_private_message checks the recipient's block list with PersonActions::read_block before inserting a message, while edit_private_message in crates/api/api_crud/src/private_message/update.rs only checks that the caller is orig_private_message.creator_id. The update then writes new content and returns the modified PrivateMessageView without consulting the recipient's block list, allowing a blocked sender to keep changing an old message that the recipient can still see and providing a post-block harassment path. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS