Lemmy CVE-2026-54740

The attacker must hold an active moderator role (any rank) on the target community as recognized by the victim instance - this requires prior legitimate or social-engineering-based moderator appointment on a federated remote instance. The victim Lemmy instance must have ActivityPub federation enabled (the default configuration) and must host communities with at least one moderator whose account resides on a different instance. Exploitation is blocked for: communities whose moderators are exclusively local accounts; instances with federation disabled; and instances running patched versions (0.19.19 or 1.0.0-alpha.18 and later). The attack requires no user interaction on the victim side and no special network positioning beyond the ability to send ActivityPub activities over HTTPS to the victim instance's inbox.

The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately characterizes the threat: network-reachable, low complexity, requiring only low-privileged access (moderator status on any federated instance), with high integrity impact confined to the vulnerable system. There is no confidentiality or availability impact, so the real-world harm is governance disruption - senior moderators ejected from communities - rather than data exfiltration or service outage. No EPSS score was provided in the input data, limiting probabilistic exploitation estimates. The vulnerability is not listed in CISA KEV, and no public proof-of-concept code has been identified. The attack surface is bounded by federation topology: only instances with ActivityPub enabled (the default) and communities that have granted moderator roles to users from external instances are reachable targets. This means single-instance deployments or tightly controlled communities are not exposed. Overall, the practical urgency is moderate - the patch is available and the impact is limited to community governance rather than system integrity - but any federated multi-instance operator should treat this as a prompt upgrade priority given the ease of exploitation (AC:L, no special tooling beyond a valid signed ActivityPub activity).

A moderator account on a federated remote Lemmy instance identifies a target community on a victim instance where that account holds moderator status alongside higher-ranked local moderators. The attacker constructs and signs a valid ActivityPub Remove activity naming a senior moderator as the object and submits it to the victim instance via standard federation channels. The victim instance's CollectionRemove handler accepts the activity, bypasses the rank check, and removes the senior moderator from the community list - with no warning or visible error to the victim or local admins beyond a moderator list change.