CVE-2026-54742: Lemmy: `CollectionAdd::Featured` does not check the post is in the community
Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collectionadd.rs and crates/apub/activities/src/community/collectionremove.rs dereference self.object as an ApubPost and update featuredcommunity without verifying that post.communityid equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.19.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.0-alpha.20
Event History
Frequently Asked Questions
Which deployments are affected?
Lemmy versions from 0.19.18 until the fixes in 0.19.19 and 1.0.0-alpha.20 are affected. Deployments running 0.19.19 or 1.0.0-alpha.20 are identified as fixed.
What access does an attacker need?
The attacker needs community moderator privileges. The issue is exercised through federated CollectionAdd or CollectionRemove activities using CollectionType::Featured.
What can a malicious moderator do?
A moderator can feature or unfeature a post belonging to another community. This can place unrelated posts into featured feeds and listings or reverse another community's legitimate featured-post decision.