Prior to Lemmy version 0.19.19 and 1.0.0-alpha.18 a lower-ranked remote moderator can send a signed ActivityPub Remove activity to strip higher-ranked moderators from a community’s moderator list. The local API rejects removal attempts that violate the moderator rank hierarchy, but the federation handling path bypasses this check, enabling an attacker to downgrade moderation privileges and potentially disrupt community governance. This flaw is a CWE-862 Privilege Escalation issue that permits abuse of the moderation hierarchy without requiring local authorization.

Lemmy instances running LemmyNet:lemmy software versions before 0.19.19 or before 1.0.0‑alpha.18 are affected. This includes all federated communities where lower‑ranked remote moderators have been granted moderator rights.

The CVSS score is 6.5, indicating a moderate severity vulnerability of type CWE-862 (Privilege Escalation). EPSS data is not presented, so the exploitation probability is unknown. The vulnerability is not listed in CISA KEV. An attacker can exploit this weakness by sending a crafted ActivityPub Remove activity as a remote moderator, effectively bypassing local moderation checks. The exploit requires only access to a lower-ranked moderator account and the ability to target a higher-ranked moderator in the same or a federated community.