Description

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank, but CollectionRemove::verify in crates/apub/activities/src/community/collection_remove.rs only calls verify_mod_action. CollectionRemove::receive dereferences self.object as an ApubPerson, creates a CommunityModeratorForm, and calls CommunityActions::leave without checking that the actor outranks the moderator identified by the object field. In communities with federated moderators, a junior moderator can therefore strip senior moderators from the community moderator list even though the local API rejects the same action. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T21:16:58.363Z",
  "pubdate": "2026-08-19T21:16:58.363Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Lemmy prior to versions 0.19.19 and 1.0.0-alpha.18, where lower-ranked remote moderators can remove higher-ranked moderators.\nThe vulnerability stems from improper authorization checks in ActivityPub activity processing for community removals.\nImpact includes the unauthorized removal of senior moderators from community moderator lists by malicious junior moderators across federated instances.\nThe risk is high for federated environments where instances trust incoming ActivityPub payloads from remote servers without enforcing equivalent local API rank validation checks.\nAttackers require lower-ranked moderator privileges on a remote instance and the ability to send signed ActivityPub Remove activities to target instances.\nExploitation bypasses local authorization logic by directly interacting with the ActivityPub handling layer instead of the local API.",
  "technicalDetails": "The vulnerability root cause lies in inconsistent authorization enforcement between the local API and the ActivityPub processing layer in Lemmy.\nWhile the local API correctly uses LocalUser::is_higher_mod_or_admin_check to enforce moderator rank hierarchies, the ActivityPub handling implementation fails to perform equivalent validation.\nSpecifically, within crates/apub/activities/src/community/collection_remove.rs, the CollectionRemove::verify function only calls verify_mod_action instead of ensuring that the actor outranks the target.\nDuring execution, CollectionRemove::receive dereferences the self.object field as an ApubPerson, constructs a CommunityModeratorForm, and subsequently invokes CommunityActions::leave.\nThis code path lacks checks to confirm whether the actor initiating the removal outranks the moderator identified by the object field.\nAttackers exploit this flaw by operating as a lower-ranked remote moderator on a federated instance and crafting a malicious, signed ActivityPub Remove activity.\nWhen transmitted to a target instance, the payload bypasses rank verification because CollectionRemove::receive processes the action without hierarchy validation.\nConsequently, the target instance executes the removal of senior moderators from the community moderator list, granting junior remote moderators the ability to strip higher-ranking administrative privileges despite local API restrictions.\nThe affected components are the ActivityPub collection remove handling logic in crates/apub/activities/src/community/collection_remove.rs across Lemmy versions prior to 0.19.19 and 1.0.0-alpha.18.\nAuthentication is required in the form of a valid remote moderator identity, but privilege requirements are intentionally bypassed due to the missing rank check."
}