EUVD-2026-62844Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Actor must hold moderator status (PR:L); exploit is delivered over the network via ActivityPub (AV:N); no confidentiality or availability impact, only moderator-list integrity (C:N/I:H/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
AnalysisAI
Missing moderator rank authorization in Lemmy's ActivityPub federation layer allows a lower-ranked remote moderator to forcibly remove a higher-ranked moderator from a community by sending a crafted signed Remove activity. Affected versions prior to 0.19.19 and 1.0.0-alpha.18 enforce hierarchy correctly in the local REST API via LocalUser::is_higher_mod_or_admin_check, but CollectionRemove::verify in the federation path skips this rank check entirely, trusting only that the actor holds some moderator role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold an active moderator role (any rank) on the target community as recognized by the victim instance - this requires prior legitimate or social-engineering-based moderator appointment on a federated remote instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N accurately characterizes the threat: network-reachable, low complexity, requiring only low-privileged access (moderator status on any federated instance), with high integrity impact confined to the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A moderator account on a federated remote Lemmy instance identifies a target community on a victim instance where that account holds moderator status alongside higher-ranked local moderators. The attacker constructs and signs a valid ActivityPub Remove activity naming a senior moderator as the object and submits it to the victim instance via standard federation channels. … |
| Remediation | The primary fix is to upgrade to Lemmy 0.19.19 (stable) or 1.0.0-alpha.18 (alpha), both of which add the moderator rank check inside the ActivityPub CollectionRemove handler for local communities. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Username enumeration in Lemmy's login endpoint allows unauthenticated remote attackers to confirm whether a given userna
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to bypass
Rate limit bypass in Lemmy prior to 0.19.19 and 1.0.0-beta.1 allows unauthenticated remote attackers to circumvent all I
Lemmy is a link aggregator and forum for the fediverse. Rated medium severity (CVSS 6.5), this vulnerability is remotely
Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated
Server-side request forgery (SSRF) in Lemmy prior to version 0.19.18 allows authenticated low-privileged users to trigge
Private message block enforcement in Lemmy is bypassed by the edit path, allowing a blocked sender to keep modifying old
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today