EUVD-2026-17039Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Lifecycle Timeline
7DescriptionCVE.org
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The respond_request() function in backend/routers/friends.py does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the /api/friends/requests/{friendship_id} endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.
AnalysisAI
{friendship_id} endpoint. The vulnerability enables any logged-in user to accept or reject friendship requests by manipulating the friendship_id parameter without authorization checks, leading to unauthorized social graph manipulation and potential account compromise via social engineering. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires authentication to parisneo/lollms versions up to 2.2.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This vulnerability presents significant real-world risk despite requiring authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with valid credentials to a multi-user lollms instance enumerates friendship request IDs by incrementing the `{friendship_id}` parameter in API calls to `/api/friends/requests/`. Upon discovering pending requests between other users, the attacker accepts friendship requests on behalf of target victims, establishing unauthorized trust relationships. … |
| Remediation | Upgrade to lollms version 2.2.0 or later, which includes the authorization fix implemented in commit c46297799f8e1e23305373f8350746b905e0e83c available at https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all parisneo/lollms installations and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today