An authorization flaw in the lollms backend allows authenticated users to improperly manage friendship requests, posing a significant risk to user privacy and platform integrity.

This is an Insecure Direct Object Reference (IDOR) vulnerability located in the respond_request function within backend/routers/friends.py. The application fails to perform necessary authorization checks on the /api/friends/requests/{friendship_id} endpoint, allowing any authenticated user to interact with friendship requests they do not own.

Successful exploitation of this vulnerability permits unauthorized manipulation of user friendships, which can lead to privacy violations and facilitated social engineering. Given the CVSS score of 8.3, this flaw is considered high severity as it permits unauthorized state changes within the application logic, potentially impacting the trust and security posture of the platform.

Immediate Action: Update the lollms software to version 2.2.0 or later to implement the necessary authorization controls.

Proactive Monitoring: Review application access logs for unusual patterns of interaction with the /api/friends/requests/ endpoint, particularly requests originating from accounts not associated with the target friendship ID.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and validate API requests to ensure that users are only accessing resources they are explicitly authorized to manage.

Public Exploit Available: No (there is no confirmed public exploit in the available data).

The vulnerability represents a significant lapse in access control that must be addressed to prevent unauthorized data manipulation. Security teams should prioritize the update to version 2.2.0 immediately to remediate the underlying authorization defect and ensure that user interactions are properly scoped and validated.