Description
Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
Published: 2026-08-19
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A community moderator is able to mark or unmark posts from other communities as featured without verifying ownership, effectively allowing a moderator to hide or showcase content from other communities. This flaw is an authorization bypass (CWE-863) that can distort community feeds, mislead users, and undermine community trust.

Affected Systems

Lemmy installations running version 0.19.18 through 0.19.19 and 1.0.0‑alpha.20 are vulnerable. The issue was fixed in the 0.19.19 release and the 1.0.0‑alpha.20 release; later versions are not affected.

Risk and Exploitability

The CVSS score of 5.1 indicates moderate severity. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. An attacker must possess moderator privileges in at least one community and send a forged CollectionAdd or CollectionRemove activity over federation; no external exploit code is required. While the impact is limited to content placement, it can be abused repeatedly to manipulate feeds across communities.

Generated by OpenCVE AI on August 20, 2026 at 11:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Lemmy to version 0.19.19 or later (including 1.0.0‑alpha.20) to apply the fix that enforces post-community validation.
  • If an immediate patch is not possible, temporarily restrict the ability for moderators to feature or unfeature posts from other communities by adjusting site configuration or removing the feature flag for cross‑community collection handling.
  • Monitor moderation logs for abnormal featured activity and revoke any suspicious moderator accounts until the upgrade is completed.

Generated by OpenCVE AI on August 20, 2026 at 11:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Lemmynet
Lemmynet lemmy
Vendors & Products Lemmynet
Lemmynet lemmy

Wed, 19 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
Title Lemmy: `CollectionAdd::Featured` does not check the post is in the community
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Lemmynet Lemmy
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-20T20:01:19.950Z

Reserved: 2026-06-15T23:12:41.964Z

Link: CVE-2026-54742

cve-icon Vulnrichment

Updated: 2026-08-20T20:00:59.326Z

cve-icon NVD

Status : Received

Published: 2026-08-19T20:17:17.093

Modified: 2026-08-20T20:17:35.410

Link: CVE-2026-54742

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-20T11:30:16Z

Weaknesses