CVE-2026-54741: Lemmy: Blocked users can edit private messages sent before the block
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. createprivatemessage checks the recipient's block list with PersonActions::readblock before inserting a message, while editprivatemessage in crates/api/apicrud/src/privatemessage/update.rs only checks that the caller is origprivatemessage.creatorid. The update then writes new content and returns the modified PrivateMessageView without consulting the recipient's block list, allowing a blocked sender to keep changing an old message that the recipient can still see and providing a post-block harassment path. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lemmyto a version that resolves this vulnerability.Fixed in 0.19.19 - Upgrade
Upgrade
Lemmyto a version that resolves this vulnerability.Fixed in 1.0.0-alpha.18
Event History
Frequently Asked Questions
Who is affected by this issue?
Recipients who have blocked another Lemmy user may still be exposed if they have an existing private message from that sender. The blocked sender can modify the content of that pre-block message, which remains visible to the recipient.
What must an attacker have to exploit it?
The attacker must be the original creator of a private message sent to the recipient before being blocked. They do not need to be able to send a new private message after the block; they exploit the edit path for their existing message.
Are new private messages from blocked senders affected?
No. The private-message creation path checks the recipient's block list and prevents new messages from a blocked sender. The missing block check applies specifically to editing existing private messages.
Which versions contain the fix?
The issue is fixed in Lemmy 0.19.19 and 1.0.0-alpha.18. Versions before those releases are affected.