Access Control Flaw in Lemmy Link Aggregator Allows Moderator Rank Abuse
CVE-2026-54740

6.5MEDIUM

Key Information:

Vendor

Lemmynet

Status
Lemmy
Vendor
CVE Published:
19 August 2026

What is CVE-2026-54740?

The Lemmy platform, a decentralized link aggregator and forum, has a critical flaw in its moderation system. Before versions 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator could falsely elevate their authority by removing a higher-ranked moderator from the community. This exploit stems from the improper verification of moderator ranks during ActivityPub operations, specifically in the CollectionRemove process. The affected system fails to enforce proper checks, allowing junior moderators to strip senior moderators' rights, despite local API protections. This vulnerability was rectified in the latest versions, emphasizing the need for users to update their instances to enhance security.

Affected Version(s)

lemmy < 0.19.19 < 0.19.19

lemmy >= 1.0.0-alpha.0, < 1.0.0-alpha.18 < 1.0.0-alpha.0, 1.0.0-alpha.18

References

https://github.com/LemmyNet/lemmy/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/LemmyNet/lemmy/pull/6475
x_refsource_MISC
https://github.com/LemmyNet/lemmy/pull/6478
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.