CVE-2026-54741 Lemmy: Blocked users can edit private messages sent before the block
Blocked users can edit previously sent private messages because the edit function fails to verify the recipient's block list, enabling post-block harassment.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54741?
CVE-2026-54741 is a medium-severity missing authorization vulnerability in LemmyNet lemmy, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipient blocks that sender, but the edit path skips the same block check. create_private_message checks the recipient's block list with PersonActions::read_block before inserting a message, while edit_private_message in crates/api/api_crud/src/private_message/update.rs only checks that the caller is orig_private_message.creator_id. The update then writes new content and returns the modified PrivateMessageView without consulting the recipient's block list, allowing a blocked sender to keep changing an old message that the recipient can still see and providing a post-block harassment path. This issue is fixed in versions 0.19.19 and 1.0.0-alpha.18.
Weakness: CWE-862
Which versions are affected by CVE-2026-54741?
How do I fix CVE-2026-54741?
No fix has been published for CVE-2026-54741 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-54741 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54741 exists.
Sources
Also known as GHSA-46g9-847m-qf8r.