CVE-2026-54741: CWE-862: Missing Authorization in LemmyNet lemmy

LemmyNet's lemmy software prior to versions 0.19.19 and 1.0.0-alpha.18 contains a missing authorization vulnerability (CWE-862) in the private message editing functionality. While new private messages are blocked from senders who are blocked by recipients, the edit path lacks this check and only verifies that the editor is the original message creator. This allows a blocked sender to continue modifying an existing private message that the recipient can still see, bypassing the intended block and enabling post-block harassment. The vulnerability is addressed by adding the missing block check in the edit_private_message function in the specified fixed versions.

An attacker who has been blocked by a recipient can still edit existing private messages sent before the block, circumventing the block and potentially harassing the recipient by modifying message content. This undermines the effectiveness of the block feature in private messaging within LemmyNet lemmy. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality and integrity.

Upgrade LemmyNet lemmy to version 0.19.19 or later, or to 1.0.0-alpha.18 or later, where this missing authorization check in the private message edit path has been fixed. No other mitigation is required as the fix addresses the root cause.