CVE-2026-0562
1 advisory.
PyPI/lollms CVE-2026-0562: high 8.3
A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i
Action: Upgrade lollms to 2.1.1 or later.
pip install lollms==2.1.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.1 | - |
Fixed versions
| 2.1.1 |
Sources
- osv: PYSEC-2026-204
- https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562/
- https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf
- https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c
CVE-2026-0562 · published · modified · JSON