CVE-2026-54740Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud46d
Disclosure
🚨*CVE* CVE-2026-54740 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by s… https://www.cve.org/CVERecord?id=CVE-2026-54740 ----- Traducción: CVE-2026-54740 Lem… https://infoflow.cloud`
Post summary
The post announces CVE‑2026‑54740 for Lemmy, noting a privilege‑escalation flaw that allows lower‑ranked moderators to remove higher‑ranked ones, and links to the official CVE record.
0000031
100 followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-54740 Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by s… https://www.cve.org/CVERecord?id=CVE-2026-54740
Post summary
The tweet announces CVE‑2026‑54740, explaining that in Lemmy versions prior to 0.19.19/1.0.0‑alpha.18 a lower-ranked remote moderator can remove a higher-ranked moderator, and indicates that the issue is fixed in later releases.
00000845
58.0K followersView on X

Explore more

Back to dashboard