---
id: CVE-2026-54742
title: Lemmy is a link aggregator and forum for the fediverse
summary: >-
  Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until
  0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature
  posts in other communities through federated CollectionAdd and
  CollectionRemove activit…
severity: none
cwe:
  - CWE-863
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54742'
references:
  - url: >-
      https://github.com/LemmyNet/lemmy/commit/108d78c592cc88bac2b0bf52ca6631be54f6fb23
    label: security-advisories@github.com
  - url: >-
      https://github.com/LemmyNet/lemmy/commit/abe256243822526dcd4bca857f7c0adeb49944f5
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/pull/6500'
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/pull/6501'
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/releases/tag/0.19.19'
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.20'
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/security/advisories/GHSA-gwfj-h8r7-792v'
    label: security-advisories@github.com
  - url: 'https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19'
    label: security-advisories@github.com
  - url: 'https://github.com/LemmyNet/lemmy/security/advisories/GHSA-gwfj-h8r7-792v'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00548
epssPercentile: 0.43509
ingestedAt: '2026-09-09T21:22:45.542Z'
---

## Overview

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verify_mod_action authorizes the actor against self.community(), the receive handlers in crates/apub/activities/src/community/collection_add.rs and crates/apub/activities/src/community/collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying that post.community_id equals community.id. A moderator can therefore target an unrelated post owned by another community, push it into featured feeds and listings, or undo another community's legitimate curation decision. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.20.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.