CVE-2026-54742

In Lemmy versions 0.19.18 through 0.19.19 and 1.0.0-alpha.20, the CollectionAdd::Featured and CollectionRemove handlers in crates/apub/activities/src/community/collection_add.rs and collection_remove.rs dereference self.object as an ApubPost and update featured_community without verifying post.co...

CVE-2026-54742 Lemmy: `CollectionAdd::Featured` does not check the post is in the community

Lemmy is a link aggregator and forum for the fediverse. From 0.19.18 until 0.19.19 and 1.0.0-alpha.20, a community moderator can feature or unfeature posts in other communities through federated CollectionAdd and CollectionRemove activities using CollectionType::Featured. After verifymodaction...

PT-2026-78677

Name of the Vulnerable Software and Affected Versions Lemmy versions 0.19.18 through 0.19.18 Lemmy versions 1.0.0-alpha.1 through 1.0.0-alpha.19 Description A community moderator can feature or unfeature posts belonging to other communities. This occurs during federated CollectionAdd and...