cve-2026-47777

CVE-2026-47777 — Mastodon Featured Collections 授权绕过 概述 我负责任地披露了一个影响 Mastodon 实验性 Featured Collections 联邦管道的高危授权绕过 漏洞。 CVE ID： CVE-2026-47777 受影响组件 ActivityPub::VerifyFeaturedItemService 弱点 CWE-345 — 数据真实性验证不足 CWE-863 — 授权不正确 CVSS v3.1 分数| 向量 ---|--- 7.5（高危）|...

CVE-2026-86112

BookWyrm through version 0.9.1 contains an authorization flaw in its Favorite and Unfavorite views (located in interaction.py). The endpoint fails to validate user visibility permissions, allowing authenticated attackers to POST a status ID to the favorite endpoint and create unauthorized interac...

CVE-2026-86112 BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

EUVD-2026-71944

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...

CVE-2026-52769

YesWiki (PHP wiki system) versions 4.6.2 through before 4.6.6 contain an unauthenticated Server-Side Request Forgery (SSRF) in the ActivityPub inbox endpoint. The route POST /api/forms/{formId}/actor/inbox (public ACL) passes the attacker-controlled keyId URL from the HTTP Signature header direct...

CVE-2026-52767 YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature checks the result of PHP's opensslverify with a loose boolean negation - if !opensslverify... throw ... . PHP's opensslverify has four possible return values: 1, 0, -1, and...

CVE-2026-52767

YesWiki versions 4.6.2 through 4.6.5 are affected by a signature-verification bypass in the ActivityPub implementation. The vulnerable function HttpSignatureService::verifySignature() in tools/bazar/services/HttpSignatureService.php uses a loose boolean negation on PHP's openssl_verify(). When op...

CVE-2026-33693

CVE-2026-33693：activitypub-federation-rust v4isinvalid 中可通过 0.0.0.0 绕过的 SSRF 漏洞（CVSS 6.5 中危） 关键词： SSRF、0.0.0.0、IP 验证绕过、activitypub-federation、Lemmy、Rust、ActivityPub 目录 概述 漏洞详情 技术分析 攻击链 影响 修复建议 CVSS v3.1 指标 时间线 参考 联系方式 免责声明 概述 activitypub-federation-rust 库（被 Lemmy 及 6...

CVE-2026-54740

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-54740

In Lemmy versions prior to 0.19.19 and 1.0.0-alpha.18, the federated ActivityPub handler CollectionRemove::receive in crates/apub/activities/src/community/collection_remove.rs omits the rank check (is_higher_mod_or_admin_check) enforced by the local API, allowing any signed ActivityPub Remove act...

CVE-2026-54740 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

EUVD-2026-62844

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-54740 Lemmy: Lower-ranked federated moderator can remove higher-ranked moderators

Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. The local API uses LocalUser::ishighermodoradmincheck to enforc...

CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

PT-2026-78675

Name of the Vulnerable Software and Affected Versions Lemmy versions prior to 0.19.19 Lemmy versions prior to 1.0.0-alpha.18 Description A lower-ranked remote moderator can remove a higher-ranked moderator by sending a signed ActivityPub Remove activity to the target instance. While the local API...

PT-2026-78677

Name of the Vulnerable Software and Affected Versions Lemmy versions 0.19.18 through 0.19.18 Lemmy versions 1.0.0-alpha.1 through 1.0.0-alpha.19 Description A community moderator can feature or unfeature posts belonging to other communities. This occurs during federated CollectionAdd and...

BIT-MASTODON-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

BIT-MASTODON-2026-72914 Mastodon: Exhausting data by an unauthenticated request to the admin retention API

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive...

CVE-2026-73038

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into...

EUVD-2026-58226

NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into...