CVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users.
Published Mar 29, 2026 · updated Jun 17, 2026 · lollms lollms
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The function in does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 29, 2026 · NIST NVD
Detected
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The function in does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the endpoint fails to verify whether the authenticated user is part of the friendship or the inten
Jun 17, 2026 · NIST NVD
Updated
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The function in does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the endpoint fails to verify whether the authenticated user is part of the friendship or the inten
Affected
- cpe lollms/lollmsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-0562
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-0562
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The function in does not implement proper authorization checks, e
nvd.nist.gov