CVE-2026-54742

Executive Summary

CVE-2026-54742 is an authorization bypass vulnerability in Lemmy, a federated link aggregator and forum platform. The flaw permits a community moderator to feature or unfeature posts in unrelated communities by exploiting insufficient verification in federated CollectionAdd and CollectionRemove activity handling. This issue affects Lemmy versions from 0.19.18 up to (but not including) 0.19.19, and version 1.0.0-alpha.20; it has been patched in 0.19.19 and 1.0.0-alpha.20. Exploitation can disrupt content curation, abuse platform moderation trust, and compromise the integrity of federated community feeds.

Technical Analysis

The vulnerability resides in the ActivityPub protocol implementation of Lemmy, specifically in the processing of federated CollectionAdd and CollectionRemove activities. These activities are part of the standard ActivityPub vocabulary and are used to manage collections of objects — in this context, to manage which posts are "featured" within a community.

The flawed logic is present in two software modules:

• crates/apub/activities/src/community/collection_add.rs
• crates/apub/activities/src/community/collection_remove.rs

Both handlers perform an authorization check through the function verify_mod_action, which verifies that the actor (the entity sending the activity) is a moderator of the community identified by self.community(). This check correctly authorizes the actor against the community specified in the activity envelope.

However, after this authorization, the handler dereferences self.object as an ApubPost (an ActivityPub representation of a post) and proceeds to update the featured_community field of that post. Critically, the code does NOT verify that post.community_id equals the community.id that was authorized in the preceding moderation check.

This is a classic confused deputy problem: the system authorizes a moderator for Community A, but then applies an action to a post that belongs to Community B. Since the moderator's authorization is scoped to Community A, they should not have the ability to alter content in Community B. The missing cross-reference check between the object's owning community and the authorized community permits this privilege escalation.

The attack is possible because ActivityPub is inherently federated — activities can originate from any server in the fediverse. A malicious or compromised moderator of any community can craft a CollectionAdd or CollectionRemove activity targeting any post on any Lemmy instance, regardless of which community legitimately owns that post.

Impact on the data model:

• For CollectionAdd: an unauthorized post can be pushed into a community's "featured" feed, manipulating curated content rankings and visibility.
• For CollectionRemove: a moderator can strip the "featured" status from a post in another community, undoing legitimate curation decisions made by that community's moderators.

This vulnerability does not require authentication bypass at the protocol level — the attacker must have legitimate moderator credentials on at least one community. However, the trust boundary violation is the core issue: moderator privileges are not properly scoped to the community they administrate.

Exploitation Scenarios

Step 1 — Reconnaissance/Identification: An attacker must already possess valid moderator credentials for some community on a Lemmy instance (version 0.19.18, or 1.0.0-alpha.20). This could be achieved by signing up and being granted moderation rights, compromising an existing moderator account, or operating a malicious Lemmy instance that has federated with the target instance. The attacker identifies the target: a post in another community they wish to feature or unfeature. No network reconnaissance is needed beyond identifying the target post's ActivityPub URL.

Step 2 — Triggering the Flaw: The attacker crafts an ActivityPub CollectionAdd (or CollectionRemove) activity where:

• The activity's actor field identifies the attacker as a moderator.
• The object field contains the URL of the target post, which belongs to a community the attacker does NOT moderate.
• The target field references the attacker's own community (or any community they moderate).

The message is sent to the target Lemmy instance's ActivityPub inbox.

Step 3 — Execution Mechanism: The receiving instance processes the activity through the vulnerable handler in collection_add.rs (or collection_remove.rs). The handler first calls verify_mod_action, which confirms the actor is a moderator of the community specified in self.community(). This check passes. The handler then dereferences self.object as an ApubPost and updates featured_community — but never checks that the post's actual owning community matches the authorized community.

Step 4 — Post-Exploitation Impact: The attacker successfully modifies the "featured" state of a post in another community. Consequences include:

• Manipulation of content visibility: Unauthorized posts can be forcefully elevated into featured feeds, increasing their prominence and potentially spreading misinformation or spam.
• Disruption of legitimate moderation: A community's legitimate curated content can be unfeatured, degrading the user experience and undermining the trust in community moderation.
• Reputational damage: Targeted communities appear to have poor or malfunctioning moderation, potentially driving users away.

No public PoC is currently available; the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

Confidentiality: Low — The vulnerability does not directly expose read-access to protected data.

Integrity: High — An attacker can modify the "featured" status of posts in communities they do not administer. This directly violates the integrity of community curation and moderation decisions.

Availability: Medium — Unauthorized "unfeature" actions can reduce the visibility of legitimate posts, effectively degrading the availability of curated content. Widespread abuse could flood featured feeds with spam, making them unusable.

Business Impact: For large Lemmy instances hosting many communities, this vulnerability enables a single malicious moderator to:

• Manipulate content ranking across the entire instance.
• Undermine community trust and user confidence.
• Potentially orchestrate coordinated disinformation campaigns by promoting specific posts across multiple communities.

Blast Radius: All federated Lemmy instances running vulnerable versions are affected. Since ActivityPub federation is transitive, a single malicious instance can attack any connected instance. The vulnerability also enables cross-instance attacks: a moderator on Instance A can feature posts on Instance B, as long as the posts themselves are federated and the ActivityPub messages are relayed correctly.

CVSS Context: No CVSS score is formally assigned for this vulnerability. Based on the described impact (privilege escalation, moderate complexity, network attack vector, high integrity impact), the severity is assessed as High in a real-world deployment, though a formal score is not available at this time.

Detection Guidance

Sigma Rule

title: Lemmy CVE-2026-54742 - Unauthorized CollectionAdd/CollectionRemove Activity
id: 8f2c9b1e-3d4a-4f5b-9c6d-2e7f8a9b0c11
status: experimental
description: Detects ActivityPub CollectionAdd and CollectionRemove activities where the object post does not belong to the community referenced in the activity.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54742
author: Valtersit Threat Intelligence
date: 2026/15/04
logsource:
    category: application
    product: lemmy
    service: lemmy-server
detection:
    selection:
        event: activitypub.receive
        activity_type:
            - "CollectionAdd"
            - "CollectionRemove"
    filter_valid:
        post.community_id|equals: activity.community_id  # Adjust to actual log field names
    condition: selection and not filter_valid
level: high
falsepositives:
    - Logging field mismatches where the community of the post and activity are derived from different normalization layers

YARA Rule

rule lemmy_cve_2026_54742_unauthorized_collection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects patterns of unauthorized CollectionAdd/CollectionRemove activities in Lemmy logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54742"
        date = "2026-04-15"
        cve = "CVE-2026-54742"
    strings:
        $a1 = "CollectionAdd" ascii wide nocase
        $a2 = "CollectionRemove" ascii wide nocase
        $b1 = "verify_mod_action" ascii wide nocase
        $b2 = "featured_community" ascii wide nocase
        $c1 = "post.community_id" ascii wide nocase
        $c2 = "community.id" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D or filesize > 100KB) and
        (($a1 or $a2) and ($b1 or $b2)) and
        (not ($c1 and $c2))  // Missing cross-reference check pattern
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-54742 - Lemmy Unauthorized CollectionAdd/Remove Activity"; flow:established,to_server; content:"POST"; http_method; content:"/inbox"; http_uri; content:"CollectionAdd"; http_client_body; nocase; content:"CollectionRemove"; http_client_body; nocase; content:"featured_community"; http_client_body; nocase; reference:cve,2026-54742; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54742; sid:10054742; rev:1;)

Elastic Detection

// Detect Lemmy ActivityPub requests containing CollectionAdd/Remove
// where target community differs from the post's origin community
sequence by source.ip
  [ network where event.category == "network" and protocol == "http"
    and http.request.method == "POST" and url.path contains "/inbox"
    and http.request.body.content contains "CollectionAdd" or http.request.body.content contains "CollectionRemove" ]
  [ file where event.category == "file" and process.name == "lemmy-server"
    and event.action in ("create", "modify")
    and file.extension == "log"
    and wildcard(file.text_content, "collection_add.rs*") or wildcard(file.text_content, "collection_remove.rs*")
    and not wildcard(file.text_content, "*post.community_id == community.id*") ]

Splunk SPL Query

index=lemmy sourcetype=lemmy_server
(activity_type="CollectionAdd" OR activity_type="CollectionRemove")
| eval community_match = if(post_community_id == activity_community_id, 1, 0)
| where community_match = 0
| table _time, source_ip, actor_username, actor_community, target_post_id, post_community_id, activity_community_id
| sort -_time

Wazuh OSSEC Rule

<group name="lemmy,">
    <rule id="100547" level="12">
        <decoded_as>json</decoded_as>
        <field name="activity_type">CollectionAdd|CollectionRemove</field>
        <regex>post.community_id.*!</regex>
        <description>CVE-2026-54742: Attempt to feature/unfeature a post in a community the actor does not moderate</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>authentication_failures,attack,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Despite the NVD description stating the issue is "fixed in versions 0.19.19 and 1.0.0-alpha.20," our tracked Patch Sources returned zero evidence of these patched versions being released or distributed. This discrepancy means the patch may have been announced but not yet made publicly available, or the version numbering may correspond to an internal/draft state. Do not assume a patch is available until official release notes confirm it.

1) Immediate Mitigations (Available Now)

• Restrict federation: If the instance does not require broad federation, restrict ActivityPub inbox access to a curated allowlist of trusted instances. This limits the pool of potential malicious actors.
• Monitor moderation activity: Implement enhanced logging on all CollectionAdd and CollectionRemove activity handling. Alert SOC teams whenever the post's owning community differs from the actor's authorized community.
• Review moderator accounts: As the attack requires moderator credentials, audit existing moderators. Remove privileges from inactive or suspicious accounts. Enforce multi-factor authentication for all moderator accounts.
• Consider disabling federation (last resort): For high-security instances, temporarily disable inbound ActivityPub federation entirely until a verified patch is available.

2) Patch/Upgrade Steps

• Continuously monitor the official Lemmy GitHub releases page and changelog for the formal release of versions 0.19.19 and 1.0.0-alpha.20.
• Once released, upgrade all lemmy-server instances to these versions or newer.
• The patch should add a verification check after verify_mod_action that ensures post.community_id == community.id before allowing the featured_community field update.
• Test the patch in a staging environment before production rollout, specifically verifying that cross-community feature/unfeature attempts are rejected.

3) Long-Term Hardening

• Code review policy: Engage a security reviewer specifically for ActivityPub handler logic, focusing on authorization boundary checks between actors, objects, and target communities.
• Fuzz testing: Add fuzzing of ActivityPub input structures to the CI/CD pipeline to catch similar authorization boundary violations.
• Federated trust model: Implement per-instance trust scoring. Only allow content-modifying activities from instances with a positive reputation.
• Rate limiting: Apply rate limiting to moderation-related activities to reduce the blast radius of a compromised moderator account.
• Regular security audits: Schedule recurring security audits of the ActivityPub implementation, particularly the community collection management modules.

References

1. NVD Entry for CVE-2026-54742: https://nvd.nist.gov/vuln/detail/CVE-2026-54742
2. Lemmy GitHub Repository: https://github.com/LemmyNet/lemmy
3. ActivityPub W3C Recommendation: https://www.w3.org/TR/activitypub/
4. CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
5. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Known Threat Actor Campaigns: No known exploit campaigns or in-the-wild exploitation have been reported for CVE-2026-54742 at the time of writing. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the ease of triggering combined with the federated nature of ActivityPub makes this a viable target once a public PoC emerges. The code pattern (missing cross-reference check after authorization) shares similarities with historically exploited "confused deputy" vulnerabilities in other federated platforms.