CVE-2026-54740

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.

• CWE-862

• https://github.com/LemmyNet/lemmy/commit/d127e714a66f34f6b9c8ea15f20097ac907cdf28
• https://github.com/LemmyNet/lemmy/commit/ede1d348344ca2027fd1bc6a0cab25575c0c3a4c
• https://github.com/LemmyNet/lemmy/pull/6475
• https://github.com/LemmyNet/lemmy/pull/6478
• https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
• https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.18
• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xmpx-2j2f-c7g7
• https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xmpx-2j2f-c7g7

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54735Prebid Server is an open-source solution for running real-ti…10
• CVE-2026-54736Phalcon is a high-performance, full-stack PHP framework. Pri…8.2
• CVE-2026-54737@phun-ky/defaults-deep is a library like lodash defaultsDeep…7.3
• CVE-2026-54738Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-54739Lemmy is a link aggregator and forum for the fediverse. Prio…6.9
• CVE-2026-5474A vulnerability was found in NASA cFS up to 7.0.0. This affe…8.8
• CVE-2026-54741Lemmy is a link aggregator and forum for the fediverse. Prio…5.3
• CVE-2026-54742Lemmy is a link aggregator and forum for the fediverse. From…5.1
• CVE-2026-54743Lemmy is a link aggregator and forum for the fediverse. Prio…6.4
• CVE-2026-54745Kubeflow Pipelines enables users to build and deploy portabl…10
• CVE-2026-54746Hatchet is a platform for orchestrating background tasks, AI…6.4
• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5