The vulnerability is an Insecure Direct Object Reference that allows any authenticated user to accept or reject friend requests that belong to other users. Because the API endpoint does not verify that the requester is part of the specified friendship, an attacker can manipulate the relationship state of other users, leading to privacy violations and enabling social engineering tactics. This flaw enables unauthorized modification of data for users other than the attacker, which can compromise confidentiality and integrity of user relationships.

Parisneo lollms is affected in all versions up to 2.1.x. The issue was fixed in version 2.2.0 and later. Users running lollms prior to 2.2.0 are vulnerable.

The CVSS score is 8.3, indicating high severity, and the EPSS score is less than 1%, suggesting a relatively low likelihood of exploitation but with potential for targeted attacks. The vulnerability is not listed in the CISA KEV catalog. An attacker only needs valid authenticated credentials to abuse the endpoint; no further access is required. The attack vector is inferred to be internal, as it requires authentication, but the lack of proper authorization checks makes the exploitation trivial once credentials are obtained.