Unsichere direkte Objektreferenz (IDOR) in parisneo/lollms

An attacker exploiting CVE-2026-0562 could gain unauthorized access to another user's friend requests within the parisneo/lollms application. By manipulating the /api/friends/requests/{friendship_id} endpoint, an attacker could accept or reject these requests, potentially leading to privacy violations, account takeover, and other malicious activities. The impact is significant due to the ease of exploitation and the potential for widespread compromise if the application is widely used. This vulnerability highlights the importance of robust authorization checks in API endpoints.

Applications utilizing parisneo/lollms in their backend and exposing friend request functionality are at risk. This includes social networking platforms, collaborative tools, or any application where users manage connections with others. Specifically, deployments using older versions of lollms (0.0.0–2.2.0) are highly vulnerable.

• python / lollms:

# Check for vulnerable versions
import subprocess
result = subprocess.run(['pip', 'show', 'parisneo-lollms'], capture_output=True, text=True)
if 'Version:' in result.stdout:
    version = result.stdout.split('Version:')[1].strip()
    if version <= '2.2.0':
        print('Vulnerable version detected!')

• generic web:

curl -I https://your-lollms-instance.com/api/friends/requests/123 | grep -i 'WWW-Authenticate'

• generic web:

# Check access logs for suspicious requests to /api/friends/requests/{friendship_id} from different user IDs
grep '/api/friends/requests/[0-9]+' /var/log/nginx/access.log | grep 'user_id=[0-9]+'

1. 2026-03-29Disclosure

   disclosure

1. Reserviert2026-01-01
2. Veröffentlicht2026-03-29
3. Geändert2026-04-22
4. EPSS aktualisiert2026-04-06

The primary mitigation for CVE-2026-0562 is to upgrade parisneo/lollms to version 2.2.0 or later. Before upgrading, review the project's release notes for any potential compatibility issues. If an upgrade is not immediately feasible, implement stricter authorization checks within the respond_request() function to ensure that users can only access and modify their own friend requests. Consider using a role-based access control (RBAC) system to further restrict access to sensitive functionality. After upgrading, verify the fix by attempting to access another user's friend requests and confirming that access is denied.