A critical authentication bypass in parisneo/lollms allows unauthenticated remote attackers to interact with sensitive file processing endpoints, posing a significant risk of service disruption.

The application fails to enforce authentication on the /api/files/extract-text endpoint, which lacks the required security dependency to verify user sessions. This allows unauthenticated remote attackers to trigger unauthorized file processing operations.

The lack of authentication on this endpoint allows for unauthenticated interaction with the application, which can be leveraged to cause denial of service through resource exhaustion or lead to the disclosure of sensitive file contents. With a CVSS score of 7.5, this vulnerability represents a high risk to business operations, as it lowers the barrier for attackers to disrupt services or exfiltrate data without requiring valid credentials.

Immediate Action: Update the lollms application to version 2.2.1 or later, or apply the fix provided in the upstream commit a6625dc83786ff21d109b0d545ca61b770607ef3.

Proactive Monitoring: Monitor server logs for unauthorized access patterns or high volumes of requests directed at the /api/files/extract-text endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict access to the /api/files/ directory, ensuring only authorized IP addresses or authenticated users can reach the affected API.

Public Exploit Available: No (a Nuclei detection template exists, but no weaponized exploit or published Proof of Concept is currently available).

Given the ease with which this vulnerability can be exploited by unauthenticated remote actors, organizations should prioritize the deployment of the vendor-supplied patch. If an immediate update is not feasible, restrict network access to the affected API endpoint to minimize the attack surface until the remediation is successfully applied.