CVE-2026-0562

Katalog CVE

CVSS 8.3 · High EPSS 0,27%

Kerentanan Incorrect Authorization pada lollms. Skor CVSS 3.1 8.3 (High) menurut NVD.

Deskripsi (NVD)

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the `/api/friends/requests/{friendship_id}` endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.

Rincian

Terbit di NVD

29 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.3 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c patch
• https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf exploit · issue tracking · advisory pihak ketiga
• https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562/