CVE-2026-54742

Name of the Vulnerable Software and Affected Versions Lemmy versions 0.19.18 through 0.19.18 Lemmy versions 1.0.0-alpha.1 through 1.0.0-alpha.19

Description A community moderator can feature or unfeature posts belonging to other communities. This occurs during federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. The receive handlers in crates/apub/activities/src/community/collection add.rs and crates/apub/activities/src/community/collection remove.rs update the featured community after the verify mod action() function authorizes the actor, but they fail to verify that the post.community id matches the community.id. Consequently, a moderator can manipulate the featured feeds and listings of unrelated communities or reverse their curation decisions.

Recommendations Update to version 0.19.19. Update to version 1.0.0-alpha.20.