CVE-2026-54742: Lemmy Privilege Escalation Vulnerability

CVE-2026-54742 Overview

CVE-2026-54742 is an authorization vulnerability in Lemmy, an open-source link aggregator and forum for the fediverse. The flaw affects Lemmy versions from 0.19.18 up to 0.19.19 and 1.0.0-alpha.20. A community moderator can feature or unfeature posts belonging to communities they do not moderate by abusing federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. The issue stems from missing validation that a target post's community_id matches the moderator's community. This weakness is classified under CWE-863: Incorrect Authorization and is fixed in versions 0.19.19 and 1.0.0-alpha.20.

Critical Impact
Any moderator on a federated Lemmy instance can manipulate featured posts in unrelated communities, overriding legitimate curation decisions across the fediverse.

Affected Products

Lemmy 0.19.18 through versions prior to 0.19.19
Lemmy 1.0.0-alpha releases prior to 1.0.0-alpha.20
Federated Lemmy instances running the ActivityPub apub crate with vulnerable collection_add and collection_remove handlers

Discovery Timeline

2026-08-19 - CVE-2026-54742 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-54742

Vulnerability Analysis

The vulnerability resides in the federated activity handlers for community collections. When Lemmy receives a CollectionAdd or CollectionRemove activity of type CollectionType::Featured, the verify_mod_action helper authorizes the actor against self.community(). This check confirms the actor is a moderator of the community that originated the activity. However, the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs then dereference self.object as an ApubPost and update the featured_community flag without confirming that post.community_id equals community.id. A malicious moderator can therefore reference a post belonging to a different community and toggle its featured status on the receiving instance.

Root Cause

The root cause is missing cross-object validation between the authorization subject and the target object [CWE-863]. Authorization is performed against the community context, but the target post is trusted implicitly. No equality check exists between post.community_id and the moderated community.id, breaking the assumption that a moderator can only act on posts within their own community.

Attack Vector

An attacker with moderator rights on any federated community crafts an ActivityPub CollectionAdd or CollectionRemove payload referencing a post URI owned by an unrelated community. The activity is signed and federated to remote instances. On receiving instances, the handler passes the verify_mod_action check because the actor is a valid moderator of their own community, then applies the featured flag to the foreign post. This lets the attacker promote arbitrary posts into featured feeds or reverse legitimate curation by other moderators.

rust

// Security patch in crates/apub/activities/src/community/collection_add.rs
// For federated post feature, write modlog and validate community (#6501)
 };
 use lemmy_db_schema_file::PersonId;
 use lemmy_diesel_utils::traits::Crud;
-use lemmy_utils::error::{LemmyError, LemmyResult};
+use lemmy_utils::error::{LemmyError, LemmyResult, UntranslatedError};
 use url::Url;

 impl CollectionAdd {

Source: GitHub Commit 108d78c

rust

// Security patch in crates/apub/src/activities/community/collection_add.rs (0.19 branch)
// Adds ModFeaturePost modlog entries alongside community validation (#6500)
   source::{
     activity::ActivitySendTargets,
     community::{Community, CommunityModerator, CommunityModeratorForm},
-    moderator::{ModAddCommunity, ModAddCommunityForm},
+    moderator::{ModAddCommunity, ModAddCommunityForm, ModFeaturePost, ModFeaturePostForm},
     person::Person,
     post::{Post, PostUpdateForm},
   },

Source: GitHub Commit abe2562

Detection Methods for CVE-2026-54742

Indicators of Compromise

Unexpected changes to the featured_community flag on posts whose community_id does not match the actor's moderated communities
Inbound ActivityPub CollectionAdd or CollectionRemove activities with CollectionType::Featured where the referenced object URI resolves to a post in a different community than the activity actor
Missing corresponding ModFeaturePost modlog entries on pre-patch versions when featured status changes

Detection Strategies

Query the Lemmy database for posts where featured_community = true and correlate the last modifier with the community's moderator list to surface mismatches
Log and inspect incoming federated collection_add and collection_remove payloads at the apub layer, flagging cases where object.community_id != community.id
Compare federated feature-state changes against mod_feature_post audit records; discrepancies indicate pre-patch exploitation

Monitoring Recommendations

Enable verbose logging in the lemmy_apub crate to capture incoming collection activities and their referenced object identifiers
Alert on repeated cross-community CollectionAdd or CollectionRemove activities originating from the same remote actor
Track anomalous spikes in featured-post activity across communities that share no moderator overlap

How to Mitigate CVE-2026-54742

Immediate Actions Required

Upgrade Lemmy to version 0.19.19 for stable deployments or 1.0.0-alpha.20 for pre-release deployments
Review the post table for entries where featured_community was toggled by remote actors and revert unauthorized changes
Audit federation peers and defederate instances observed abusing the flaw pending their upgrade

Patch Information

The fix is delivered in Lemmy v0.19.19 and v1.0.0-alpha.20. The relevant changes are tracked in Pull Request #6500 and Pull Request #6501, which add community validation in the collection_add and collection_remove receive handlers and write ModFeaturePost modlog entries for federated feature actions. Full details are documented in GHSA-gwfj-h8r7-792v and the Lemmy v0.19.19 release announcement.

Workarounds

No supported workaround exists short of upgrading; administrators unable to patch immediately should restrict federation with untrusted instances
Temporarily disable community featuring on the instance through admin controls if available, reducing exposure until the upgrade completes
Monitor and manually reconcile featured-post state on high-visibility communities until the patch is deployed

bash

# Upgrade to the patched Lemmy release using Docker Compose
docker compose pull
sed -i 's/lemmy:0\.19\.18/lemmy:0.19.19/g' docker-compose.yml
docker compose up -d lemmy

# Verify running version
docker compose exec lemmy /app/lemmy --version