CVE-2026-0562

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the `/api/friends/requests/{friendship_id}` endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c	Patch
https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*

History

31 Mar 2026, 19:30

Type	Values Removed	Values Added
CPE		cpe:2.3:a:lollms:lollms::::::::
First Time		Lollms Lollms lollms
References	~~() https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c -~~	() https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c - Patch
References	~~() https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf -~~	() https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf - Exploit, Issue Tracking, Third Party Advisory

29 Mar 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-29 18:16

Updated : 2026-03-31 19:30

NVD link : CVE-2026-0562

Mitre link : CVE-2026-0562

CVE.ORG link : CVE-2026-0562

JSON object : View

Products Affected

lollms

lollms

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-0562", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 2.8}]}, "published": "2026-03-29T18:16:14.460", "references": [{"url": "https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "security@huntr.dev"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the `/api/friends/requests/{friendship_id}` endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0."}], "lastModified": "2026-03-31T19:30:04.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lollms:lollms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7118851E-5C3C-499B-BBB5-0327B7FD85AF", "versionEndIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}