CVE-2026-54740

This vulnerability exposes a fundamental authorization gap in Lemmy's federation layer: the local API correctly enforces moderator rank hierarchy through `is_higher_mod_or_admin_check`, preventing junior moderators from demoting senior ones. The ActivityPub receiver (`CollectionRemove::verify`) only confirms the actor is a moderator and that the activity is cryptographically signed — it assumes the remote instance already enforced its own permission rules. This assumption collapses when remote instances lack rank semantics or have different enforcement models. The attack vector is straightforward: a compromised or careless remote moderator account — or a remote instance with no rank enforcement — sends a validly-signed Remove activity that demotes a senior local moderator. The local instance cannot distinguish this from a legitimate demotion because it only sees a cryptographically valid activity from a valid moderator actor. The dangerous implication is cascade topology: an attacker can sequentially remove the highest-ranked moderators, becoming the highest-ranked actor after each removal, ultimately controlling the entire moderation layer through individually innocuous operations. The fix requires `CollectionRemove::receive` to dereference the object as an ApubPerson, retrieve the target's rank, and compare it to the actor's rank before honoring the removal. However, this introduces a harder problem: retrieving reliable rank data from third-party instances that may not expose it. If rank metadata is unavailable or inconsistent, your instance must decide between rejecting legitimate federation or falling back to heuristics — neither is secure. Audit your federation handlers across the codebase for this exact pattern: signature verification present but authorization logic absent. The authentication/authorization conflation is a genetic weakness in ActivityPub implementations system-wide, not a one-off bug. Implement monitoring for cross-instance rank inversion attempts — you cannot detect an attack in progress if you are not tracking rank changes from remote actors.

Reviewed through automated stages and approved by a human before publication.