CVE-2026-0562 Insecure Direct Object Reference (IDOR) in parisneo/lollms

High 8.3 Published 29 Mar 2026 Updated 22 Apr 2026

Authenticated users can accept or reject friend requests belonging to other users due to missing authorization checks in the API endpoint.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-0562?

CVE-2026-0562 is a high-severity missing authorization vulnerability in parisneo/lollms, published on 29 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function in `backend/routers/friends.py` does not implement proper authorization checks, enabling Insecure Direct Object Reference (IDOR) attacks. Specifically, the `/api/friends/requests/{friendship_id}` endpoint fails to verify whether the authenticated user is part of the friendship or the intended recipient of the request. This vulnerability can lead to unauthorized access, privacy violations, and potential social engineering attacks. The issue has been addressed in version 2.2.0.

Weakness: CWE-863

Which versions are affected by CVE-2026-0562?

1 open source package ship an affected version, including lollms. It affects 1 product.

Package	Affected	Fixed in
`lollms` PyPI	All versions	`2.1.1`

Products include Lollms Lollms.

How do I fix CVE-2026-0562?

Upgrade lollms to 2.1.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-0562 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-0562 exists.

Sources

Also known as GHSA-2j48-mfm5-x2hv, PYSEC-2026-204.