{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "0.19.19"
              },
              {
                "introduced": "1.0.0-alpha.0"
              },
              {
                "fixed": "1.0.0-alpha.18"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "introduced": "1edc9f922debc2c5b1aaaf29c495d7d4fe711b94"
            },
            {
              "fixed": "f6e986e7e54d456aa1ffec38f1576c5bb15e0afd"
            },
            {
              "fixed": "0ab1cd744b659d0f5e35b77dbded142bed550487"
            },
            {
              "fixed": "d127e714a66f34f6b9c8ea15f20097ac907cdf28"
            },
            {
              "fixed": "ede1d348344ca2027fd1bc6a0cab25575c0c3a4c"
            }
          ],
          "repo": "https://github.com/lemmynet/lemmy",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-xmpx-2j2f-c7g7"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54740.json"
  },
  "details": "Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.",
  "id": "CVE-2026-54740",
  "modified": "2026-08-22T03:31:15.657939021Z",
  "published": "2026-08-19T20:14:29.391Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/LemmyNet/lemmy/releases/tag/0.19.19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/LemmyNet/lemmy/releases/tag/1.0.0-alpha.18"
    },
    {
      "type": "WEB",
      "url": "https://join-lemmy.org/news/2026-06-09_-_Lemmy_Release_v0.19.19"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54740.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/LemmyNet/lemmy/security/advisories/GHSA-xmpx-2j2f-c7g7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54740"
    },
    {
      "type": "FIX",
      "url": "https://github.com/LemmyNet/lemmy/commit/d127e714a66f34f6b9c8ea15f20097ac907cdf28"
    },
    {
      "type": "FIX",
      "url": "https://github.com/LemmyNet/lemmy/commit/ede1d348344ca2027fd1bc6a0cab25575c0c3a4c"
    },
    {
      "type": "FIX",
      "url": "https://github.com/LemmyNet/lemmy/pull/6475"
    },
    {
      "type": "FIX",
      "url": "https://github.com/LemmyNet/lemmy/pull/6478"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators"
}