The vulnerability allows a user to force the acceptance of a friend request on another account by crafting a request. This bypasses normal authorization controls, enabling an attacker to establish a friendship relationship without the target account’s consent. The weakness is classified as improper authorization (CWE‑285).

The flaw exists in the friends feature of DNN (formerly DotNetNuke) from version 6.0.0 up to, but not including, version 10.2.2 of Dnn.Platform. Versions prior to 10.2.2 are vulnerable; version 10.2.2 includes the fix.

The CVSS score of 4.3 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting a low to moderate likelihood of exploitation. Attackers would need knowledge of the target user’s account context and the ability to send a forged request; the attack vector is likely web-based, accessed through the application’s friends feature, based on the description. With the flaw, an attacker can force the acceptance of a friend request on another account, enabling an unauthorized friendship relationship.