CVE-2026-54740

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-alpha.18

Description A lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. While the local API uses LocalUser::is higher mod or admin check to enforce moderator rank, the CollectionRemove::verify function in crates/apub/activities/src/community/collection remove.rs only calls verify mod action. Specifically, CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without verifying that the actor outranks the moderator identified by the object field. This allows junior moderators in communities with federated moderators to strip senior moderators from the community moderator list.

Recommendations Update to version 0.19.19. Update to version 1.0.0-alpha.18.