CVE-2026-54742

Received Received - Intake

Privilege Escalation in Lemmy via Featured Post Manipulation

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-54742

EUVD

EUVD-2026-62841

Affected Vendors & Products

Vendor	Product	Version / Range
lemmy	lemmy	to 0.19.19 (exc)
lemmy	lemmy	0.19.19
lemmy	lemmy	1.0.0-alpha.20
lemmy	lemmy	0.19.18

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Lemmy allows a community moderator to feature or unfeature posts in other communities without proper validation. The moderator can manipulate posts from unrelated communities into featured feeds or undo legitimate curation decisions in another community.

Detection Guidance

This vulnerability involves improper validation in Lemmy's federated post feature. To detect it, check if your Lemmy instance is running versions between 0.19.18 and 0.19.19 or 1.0.0-alpha.20. Review moderation logs for unexpected featured/unfeatured posts across unrelated communities. Inspect network traffic for unusual federated CollectionAdd or CollectionRemove activities targeting posts outside the moderator's community.

Impact Analysis

If you are a Lemmy user, this could lead to unrelated or unwanted content appearing in your community's featured posts. It may also disrupt legitimate moderation actions by other communities, affecting your feed and discussions.

Mitigation Strategies

Upgrade to Lemmy version 0.19.19 or 1.0.0-alpha.20 immediately. Review and remove any unauthorized featured posts in communities. Monitor moderation logs for suspicious activities. Ensure all moderators are aware of proper community boundaries and validation requirements.

Hi! I’m here to help you understand CVE-2026-54742. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70