CVE-2026-54740: Lemmy Privilege Escalation Vulnerability

CVE-2026-54740 Overview

CVE-2026-54740 is a missing authorization vulnerability [CWE-862] in Lemmy, a federated link aggregator and forum for the fediverse. Prior to versions 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API correctly enforces moderator rank through LocalUser::is_higher_mod_or_admin_check, but the federated code path in CollectionRemove::verify skips this check. Attackers with any moderator role on a federated community can therefore strip senior moderators, including admins, from the community moderator list.

Critical Impact
A junior remote moderator can demote or remove senior moderators from federated communities by crafting an ActivityPub Remove activity, undermining community governance and access control.

Affected Products

Lemmy versions prior to 0.19.19
Lemmy 1.0.0 alpha releases prior to 1.0.0-alpha.18
Any Lemmy instance participating in federation with untrusted remote moderators

Discovery Timeline

2026-08-19 - CVE-2026-54740 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-54740

Vulnerability Analysis

The vulnerability resides in crates/apub/activities/src/community/collection_remove.rs. The local Lemmy API enforces moderator hierarchy through LocalUser::is_higher_mod_or_admin_check, which prevents junior moderators from acting against senior ones. The federated ActivityPub handler for community collection changes does not perform this check.

CollectionRemove::verify only invokes verify_mod_action, which confirms that the actor is a moderator but does not compare the actor's rank against the target. CollectionRemove::receive then dereferences self.object as an ApubPerson, builds a CommunityModeratorForm, and calls CommunityActions::leave on the target user. The result is an inconsistent authorization model where federated peers bypass a rule the local API enforces.

The vulnerability affects integrity of community governance. Attackers cannot read confidential data or disable the service, but they can manipulate the moderator roster to seize control of federated communities.

Root Cause

The root cause is a missing authorization check on the federated code path. The verification logic does not compare the acting moderator's rank against the moderator identified in the object field of the incoming Remove activity. The local API and the federated API therefore enforce different policies for the same action.

Attack Vector

An attacker holding a lower-ranked moderator role on a federated community signs an ActivityPub Remove activity that targets a higher-ranked moderator. The activity is delivered to the community's home instance, which validates the signature and moderator status but not the rank hierarchy. The target instance then removes the senior moderator from the community moderator list.

rust

// Security patch (excerpt) in crates/apub/activities/src/community/collection_remove.rs
// Adds LocalUser import to enforce moderator hierarchy on the federated path.
  source::{
    activity::ActivitySendTargets,
    community::{Community, CommunityActions, CommunityModeratorForm},
+   local_user::LocalUser,
    modlog::{Modlog, ModlogInsertForm},
    post::{Post, PostUpdateForm},
  },

Source: GitHub Commit d127e71

The 0.19 branch received an equivalent fix, wiring LocalUser into the moderator-removal handler so the federated path can compare actor rank against the target moderator before applying the change. See GitHub Commit ede1d34.

Detection Methods for CVE-2026-54740

Indicators of Compromise

Unexpected removals of moderators from federated community rosters, especially where the acting moderator ranks below the removed moderator.
Inbound ActivityPub Remove activities targeting community moderator collections that originate from lower-ranked remote actors.
Modlog entries showing moderator demotions attributed to remote actors without a corresponding local API call.

Detection Strategies

Audit the Lemmy modlog table for ModRemoveCommunity or moderator-leave events sourced from federated instances and correlate actor rank with target rank.
Inspect ActivityPub inbox logs for Remove activities where the actor and object both resolve to community moderators, and flag cases where the actor is junior.
Compare federated moderator changes against the outcome the local API would produce using LocalUser::is_higher_mod_or_admin_check to identify divergences.

Monitoring Recommendations

Enable verbose federation logging for community collection updates and forward the logs to a centralized SIEM for retention and analysis.
Alert on any moderator roster change where the acting instance is remote and the target is an admin or top-tier moderator.
Track Lemmy release channels and monitor instance version banners to identify unpatched federated peers that could originate the abusive activity.

How to Mitigate CVE-2026-54740

Immediate Actions Required

Upgrade Lemmy to 0.19.19 or 1.0.0-alpha.18, which add the missing rank check to the federated CollectionRemove handler.
Review the current moderator roster of every federated community and reinstate any senior moderators removed prior to patching.
Restrict federation with instances that have not applied the fix, particularly those hosting communities with cross-instance moderator teams.

Patch Information

The fix is delivered in Lemmy 0.19.19 and 1.0.0-alpha.18. Technical details are documented in GHSA-xmpx-2j2f-c7g7, with implementation in pull requests #6475 and #6478. Release notes are available on the Lemmy news page.

Workarounds

Temporarily remove remote moderators from federated communities until the instance is upgraded.
Limit moderator assignments on high-value communities to accounts on the local instance to reduce exposure to federated moderator actions.
Increase moderator log review cadence and require manual approval workflows for reinstating moderators after roster changes.

bash

# Upgrade example using Docker Compose
docker compose pull lemmy
docker compose up -d lemmy
# Verify running version
docker exec lemmy lemmy_server --version