CVE-2026-54740mediumCWE-862

CVE-2026-54740: fallo de gravedad media en LemmyNet lemmy

Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear lemmy

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
LemmyNet · lemmy
CVEs relacionadas — LemmyNet lemmy

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-54739MEDIUMLemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialEPSS 0.6%CVE-2026-54738MEDIUMLemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoEPSS 0.6%CVE-2026-54742MEDIUMLemmy: `CollectionAdd::Featured` does not check the post is in the communityEPSS 0.5%CVE-2026-54743MEDIUMLemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embedEPSS 0.5%CVE-2024-23649HIGHAny authenticated user may obtain private message details from other users on the same instanceEPSS 0.5%CVE-2026-54741MEDIUMLemmy: Blocked users can edit private messages sent before the blockEPSS 0.5%