The flaw occurs in the private message update routine, where the block check that prevents new messages is omitted. An attacker who has been blocked by a recipient can continue to edit any private message that was sent before the block. The edit is permitted because the only guard is that the caller is the original creator. The result is that a blocked user can repeatedly modify content that the recipient can still view, creating a harassment or abuse channel. The weakness underlying this is missing access control on privileged operations (CWE-862).

The vulnerability affects LemmyNet's Lemmy platform. Versions earlier than 0.19.19 of the stable releases and earlier than 1.0.0-alpha.18 of the alpha line are susceptible. All instances running those releases should be considered affected until patched.

This flaw presents a moderate severity, reflected in the CVSS score of 5.3. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must have a private message relationship and be blocked by the target; once those conditions are met, the block list check is bypassed during edit. The lack of a block verification in the edit path allows repeated modification, making this a viable post‑block harassment vector. The risk remains predominantly in user‑to‑user relationships and does not expose broader system compromise.