CVE-2026-54740mediumCWE-862

CVE-2026-54740: falha de média gravidade em LemmyNet lemmy

Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar lemmy

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
LemmyNet · lemmy
CVEs relacionadas — LemmyNet lemmy

No mesmo produto, das mais perigosas para as menos.

CVE-2026-54739MEDIUMLemmy: Login Endpoint User Enumeration via HTTP Response Code DifferentialEPSS 0.6%CVE-2026-54738MEDIUMLemmy: Rate limit bypass via X-Forwarded-For header spoofing in actix-web ConnectionInfoEPSS 0.6%CVE-2026-54742MEDIUMLemmy: `CollectionAdd::Featured` does not check the post is in the communityEPSS 0.5%CVE-2026-54743MEDIUMLemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embedEPSS 0.5%CVE-2024-23649HIGHAny authenticated user may obtain private message details from other users on the same instanceEPSS 0.5%CVE-2026-54741MEDIUMLemmy: Blocked users can edit private messages sent before the blockEPSS 0.5%