This vulnerability exposes a fundamental authorization gap in Lemmy's federation layer: the local API correctly enforces moderator rank hierarchy through is_higher_mod_or_admin_check, preventing junior moderators from demoting senior ones. The ActivityPub receiver (CollectionRemove::verify) only confirms the actor is a moderator and that the activity is cryptographically signed — it assumes the remote instance already enforced its own permission rules. This assumption collapses when remote instances lack rank semantics or have different enforcement models.
The attack vector is straightforward: a compromised or careless remote moderator account — or a remote instance with no rank enforcement — sends a validly-signed Remove activity that demotes a senior local moderator. The local instance cannot distinguish this from a legitimate demotion because it only sees a cryptographically valid activity from a valid moderator actor. The dangerous implication is cascade topology: an attacker can sequentially remove the highest-ranked moderators, becoming the highest-ranked actor after each removal, ultimately controlling the entire moderation layer through individually innocuous operations.
The fix requires CollectionRemove::receive to dereference the object as an ApubPerson, retrieve the target's rank, and compare it to the actor's rank before honoring the removal. However, this introduces a harder problem: retrieving reliable rank data from third-party instances that may not expose it. If rank metadata is unavailable or inconsistent, your instance must decide between rejecting legitimate federation or falling back to heuristics — neither is secure.
Audit your federation handlers across the codebase for this exact pattern: signature verification present but authorization logic absent. The authentication/authorization conflation is a genetic weakness in ActivityPub implementations system-wide, not a one-off bug. Implement monitoring for cross-instance rank inversion attempts — you cannot detect an attack in progress if you are not tracking rank changes from remote actors.