{"action":"Upgrade lollms to 2.1.1 or later.","affected":[{"fixed":"2.1.1","introduced":"0"}],"component":"lollms","cve_ids":["CVE-2026-0562"],"ecosystem":"PyPI","epss":0.00273,"exploited":false,"fixed_versions":["2.1.1"],"id":"tcs_01M5KGX4SSJQCZQHG2E0D6GS6A","modified_at":"2026-06-06T20:00:05.083074138Z","published_at":"2026-03-29T18:16:14.460Z","references":["https://osv.dev/vulnerability/PYSEC-2026-204","https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562/","https://huntr.com/bounties/6aab01ca-a138-4a1d-bef9-3bce145359bf","https://github.com/parisneo/lollms/commit/c46297799f8e1e23305373f8350746b905e0e83c"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-204","url":"https://osv.dev/vulnerability/PYSEC-2026-204"}],"summary":"A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other users. The `respond_request()` function i"}