CVE-2026-54741

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-alpha.18

Description An issue exists where the system fails to verify the recipient's block list when editing a private message. While the create private message function utilizes PersonActions::read block to prevent messages from blocked senders, the edit private message function in crates/api/api crud/src/private message/update.rs only verifies if the caller is the orig private message.creator id. This allows a blocked sender to modify the content of an existing message that the recipient can still see, enabling a path for harassment after a block has been implemented.

Recommendations Update to version 0.19.19. Update to version 1.0.0-alpha.18.