CVE-2026-54742: CWE-863: Incorrect Authorization in LemmyNet lemmy
CVE-2026-54742 is an incorrect authorization vulnerability in LemmyNet's lemmy software affecting versions prior to 0.19.19 and version 1.0.0-alpha.20. It allows a community moderator to feature or unfeature posts in other communities without proper verification of community ownership, enabling unauthorized modification of featured content across communities. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
AI Analysis
Technical Summary
LemmyNet lemmy versions from 0.19.18 until 0.19.19 and 1.0.0-alpha.20 contain an authorization flaw (CWE-863) where community moderators can manipulate featured posts in communities they do not belong to. The vulnerability arises because the receive handlers for CollectionAdd and CollectionRemove activities do not verify that the post's community ID matches the community performing the action after initial authorization checks. This allows moderators to push unrelated posts into featured feeds or undo legitimate curation decisions of other communities. The flaw is resolved in versions 0.19.19 and 1.0.0-alpha.20.
Potential Impact
An attacker with community moderator privileges can improperly feature or unfeature posts in communities they do not moderate. This undermines community content curation integrity by allowing unauthorized changes to featured posts across federated communities. There is no indication of privilege escalation beyond moderator rights or direct data compromise.
Mitigation Recommendations
Upgrade LemmyNet lemmy to version 0.19.19 or later, or to 1.0.0-alpha.20 or later, where this authorization issue is fixed. No other mitigations are indicated. Patch status is not explicitly stated but the description confirms the issue is fixed in these versions.
CVE-2026-54742: CWE-863: Incorrect Authorization in LemmyNet lemmy
Description
CVE-2026-54742 is an incorrect authorization vulnerability in LemmyNet's lemmy software affecting versions prior to 0.19.19 and version 1.0.0-alpha.20. It allows a community moderator to feature or unfeature posts in other communities without proper verification of community ownership, enabling unauthorized modification of featured content across communities. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.
CVSS v4.0
Score 5.1medium
Affected software
pkg:cargo/github/LemmyNet/lemmyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
LemmyNet lemmy versions from 0.19.18 until 0.19.19 and 1.0.0-alpha.20 contain an authorization flaw (CWE-863) where community moderators can manipulate featured posts in communities they do not belong to. The vulnerability arises because the receive handlers for CollectionAdd and CollectionRemove activities do not verify that the post's community ID matches the community performing the action after initial authorization checks. This allows moderators to push unrelated posts into featured feeds or undo legitimate curation decisions of other communities. The flaw is resolved in versions 0.19.19 and 1.0.0-alpha.20.
Potential Impact
An attacker with community moderator privileges can improperly feature or unfeature posts in communities they do not moderate. This undermines community content curation integrity by allowing unauthorized changes to featured posts across federated communities. There is no indication of privilege escalation beyond moderator rights or direct data compromise.
Mitigation Recommendations
Upgrade LemmyNet lemmy to version 0.19.19 or later, or to 1.0.0-alpha.20 or later, where this authorization issue is fixed. No other mitigations are indicated. Patch status is not explicitly stated but the description confirms the issue is fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T23:12:41.964Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a86109dacd9273b4993ac9b
Added to database: 08/19/2026, 20:22:53 UTC
Last enriched: 08/19/2026, 20:40:57 UTC
Last updated: 08/19/2026, 20:40:57 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.