Lemmy: `CollectionAdd::Featured` does not check the post is in the community
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA lemmy (LemmyNet) Fixed in 0.19.19, 1.0.0-alpha.20
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54742
References
Other 8
- https://github.com/LemmyNet/lemmy/security/advisories/GHSA-gwfj-h8r7-792v
- https://github.com/LemmyNet/lemmy/pull/6500
- https://github.com/LemmyNet/lemmy/pull/6501
- https://github.com/LemmyNet/lemmy/commit/108d78c592cc88bac2b0bf52ca6631be54f6fb23
- https://github.com/LemmyNet/lemmy/commit/abe256243822526dcd4bca857f7c0adeb49944f5
- https://github.com/LemmyNet/lemmy/releases/tag/0.19.19
- https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.20
- https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19
More LemmyNet vulnerabilities
- TI-2026-23295 Lemmy: Unauthenticated SSRF via file_type query parameter injection in image endpoint CVSS 4.0HIGH 7.7
- TI-2026-26073 Lemmy's Activitypub-Federation has SSRF via 0.0.0.0 bypass in activitypub-federation-rust v4_is_invalid() CVSS 3.1MEDIUM 6.5
- TI-2026-39555 Lemmy: Stored XSS via markdown image alt-text in lemmy-ui html5-embed CVSS 4.0MEDIUM 6.4
- TI-2026-39552 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators CVSS 3.1MEDIUM 6.5
- TI-2026-30504 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image CVSS 3.1MEDIUM 6.5
- TI-2026-39553 Lemmy: Blocked users can edit private messages sent before the block CVSS 4.0MEDIUM 5.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences