CVE-2026-54740

Received Received - Intake

Privilege Escalation in Lemmy via ActivityPub

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-54740

EUVD

EUVD-2026-62844

Affected Vendors & Products

Vendor	Product	Version / Range
lemmy	lemmy	to 0.19.19 (inc)
lemmy	lemmy	to 1.0.0-alpha.18 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Lemmy allows a lower-ranked remote moderator to remove a higher-ranked moderator by sending a signed ActivityPub Remove activity. The local API enforces moderator rank checks, but the federated activity verification does not, allowing unauthorized removal of senior moderators.

Detection Guidance

This vulnerability involves improper moderator rank checks in Lemmy instances. To detect it, check Lemmy server logs for unexpected CommunityModeratorForm submissions or CommunityActions::leave calls. Look for Remove activities from lower-ranked moderators targeting higher-ranked ones. Verify if your Lemmy version is below 0.19.19 or 1.0.0-alpha.18.

Impact Analysis

If exploited, this flaw could allow unauthorized users to remove legitimate moderators from communities, disrupting community management and potentially leading to misuse of moderation privileges.

Compliance Impact

This vulnerability allows lower-ranked moderators to remove higher-ranked moderators in Lemmy instances, potentially disrupting community governance. While not directly related to data protection standards like GDPR or HIPAA, it could indirectly impact compliance by enabling unauthorized changes to moderator access controls, which might affect data handling or access management in federated environments.

Mitigation Strategies

Upgrade Lemmy to version 0.19.19 or 1.0.0-alpha.18 or later to address the vulnerability. Review moderator permissions and community settings to ensure no unauthorized changes have occurred.

Hi! I’m here to help you understand CVE-2026-54740. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70