Skip to main content

Lemmy CVE-2026-54742

| EUVDEUVD-2026-62841 MEDIUM
Incorrect Authorization (CWE-863)
2026-08-19 security-advisories@github.com
Authentication Bypass
5.1
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
2.7 LOW

Community moderator authentication required (PR:H); network-reachable via federation (AV:N); impact is solely limited integrity of post featuring state with no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 19, 2026 - 21:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 21:05 vuln.today
Analysis Generated
Aug 19, 2026 - 21:05 vuln.today

DescriptionCVE.org

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.

AnalysisAI

Cross-community post featuring abuse in Lemmy allows authenticated community moderators to manipulate post visibility across unrelated communities via crafted federated ActivityPub activities. Affected versions span 0.19.0 through 0.19.18 (stable) and all alpha builds prior to 1.0.0-alpha.20. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain community moderator role
Delivery
Craft CollectionAdd or CollectionRemove ActivityPub activity
Exploit
Reference post from an unrelated target community
Install
Submit activity through federation layer
C2
verify_mod_action approves actor against own community
Execute
Missing community_id check bypassed
Impact
Post featured state updated without authorization
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to hold an active community moderator role on a Lemmy instance running affected versions (0.19.0-0.19.18 stable or pre-1.0.0-alpha.20 alpha). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.1 with vector AV:N/AC:L/AT:N/PR:H/UI:N reflects a network-reachable flaw of low attack complexity but gated behind a high-privilege prerequisite - community moderator role. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A community moderator on a Lemmy instance running an affected version crafts a CollectionAdd ActivityPub activity that claims to be for their legitimate community but references a post ID belonging to a different, unrelated community. The federation handler validates their moderator status against their own community and then updates the targeted post's featured_community flag without checking the community mismatch, causing the unrelated post to appear in the attacker's community featured feed or removing a legitimate curation decision from another community. …
Remediation Upgrade Lemmy to version 0.19.19 on the stable channel or 1.0.0-alpha.20 on the alpha channel; both are available at https://github.com/LemmyNet/lemmy/releases. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-54742 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy