CVE-2026-54742

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.

• CWE-863

• https://github.com/LemmyNet/lemmy/commit/108d78c592cc88bac2b0bf52ca6631be54f6fb23
• https://github.com/LemmyNet/lemmy/commit/abe256243822526dcd4bca857f7c0adeb49944f5
• https://github.com/LemmyNet/lemmy/pull/6500
• https://github.com/LemmyNet/lemmy/pull/6501
• https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
• https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.20
• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-gwfj-h8r7-792v
• https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
• https://github.com/LemmyNet/lemmy/security/advisories/GHSA-gwfj-h8r7-792v

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54737@phun-ky/defaults-deep is a library like lodash defaultsDeep…7.3
• CVE-2026-54738Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-54739Lemmy is a link aggregator and forum for the fediverse. Prio…6.9
• CVE-2026-5474A vulnerability was found in NASA cFS up to 7.0.0. This affe…8.8
• CVE-2026-54740Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-54741Lemmy is a link aggregator and forum for the fediverse. Prio…5.3
• CVE-2026-54743Lemmy is a link aggregator and forum for the fediverse. Prio…6.4
• CVE-2026-54745Kubeflow Pipelines enables users to build and deploy portabl…10
• CVE-2026-54746Hatchet is a platform for orchestrating background tasks, AI…6.4
• CVE-2026-5475A vulnerability was determined in NASA cFS up to 7.0.0. This…5.5
• CVE-2026-54752NetBox Device Type Library is a collection of community-sour…9.6
• CVE-2026-54753Nx is a monorepo solution for TypeScript and polyglot codeba…5.9