CVE-2026-1117

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1117", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2026-01-17T18:09:10.741Z", "datePublished": "2026-02-02T09:55:26.972Z", "dateUpdated": "2026-02-02T17:49:47.974Z"}, "containers": {"cna": {"title": "Improper Access Control in parisneo/lollms", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-02-02T09:55:26.972Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service."}], "affected": [{"vendor": "parisneo", "product": "parisneo/lollms", "versions": [{"version": "unspecified", "lessThan": "2.0.0", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/d2846a7f-0140-4105-b1bb-5ef64ec8b829"}, {"url": "https://github.com/parisneo/lollms/commit/36a5b513dfefe9c2913bf9b618457b4fea603e3b"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-284 Improper Access Control", "cweId": "CWE-284"}]}], "source": {"advisory": "d2846a7f-0140-4105-b1bb-5ef64ec8b829", "discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T17:49:35.417679Z", "id": "CVE-2026-1117", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:49:47.974Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1117", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-02T17:49:35.417679Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T17:49:43.693Z"}}], "cna": {"title": "Improper Access Control in parisneo/lollms", "source": {"advisory": "d2846a7f-0140-4105-b1bb-5ef64ec8b829", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "parisneo", "product": "parisneo/lollms", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "2.0.0", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/d2846a7f-0140-4105-b1bb-5ef64ec8b829"}, {"url": "https://github.com/parisneo/lollms/commit/36a5b513dfefe9c2913bf9b618457b4fea603e3b"}], "descriptions": [{"lang": "en", "value": "A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2026-02-02T09:55:26.972Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1117", "state": "PUBLISHED", "dateUpdated": "2026-02-02T17:49:47.974Z", "dateReserved": "2026-01-17T18:09:10.741Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2026-02-02T09:55:26.972Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "parisneo/lollms", "vendor": "parisneo", "versions": [{"lessThan": "2.0.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "security@huntr.dev"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service."}, {"lang": "es", "value": "Una vulnerabilidad en el componente 'lollms_generation_events.py' de parisneo/lollms versi\u00f3n 5.9.0 permite acceso no autenticado a eventos sensibles de Socket.IO. La funci\u00f3n 'add_events' registra manejadores de eventos como 'generate_text', 'cancel_generation', 'generate_msg' y 'generate_msg_from' sin implementar comprobaciones de autenticaci\u00f3n o autorizaci\u00f3n. Esto permite a clientes no autenticados ejecutar operaciones que consumen muchos recursos o que alteran el estado, lo que lleva a una potencial denegaci\u00f3n de servicio, corrupci\u00f3n de estado y condiciones de carrera. Adem\u00e1s, el uso de indicadores globales ('lollmsElfServer.busy', 'lollmsElfServer.cancel_gen') para la gesti\u00f3n de estado en un entorno multi-cliente introduce vulnerabilidades adicionales, permitiendo que las acciones de un cliente afecten el estado del servidor y las operaciones de otros clientes. La falta de un control de acceso adecuado y la dependencia de una gesti\u00f3n de estado global insegura impacta significativamente la disponibilidad y la integridad del servicio."}], "id": "CVE-2026-1117", "lastModified": "2026-06-17T10:15:07.057", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security@huntr.dev", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1117", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T17:49:35.417679Z", "version": "2.0.3"}}]}, "published": "2026-02-02T10:16:06.500", "references": [{"source": "security@huntr.dev", "url": "https://github.com/parisneo/lollms/commit/36a5b513dfefe9c2913bf9b618457b4fea603e3b"}, {"source": "security@huntr.dev", "url": "https://huntr.com/bounties/d2846a7f-0140-4105-b1bb-5ef64ec8b829"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security@huntr.dev", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:40:19.508755+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest patched version of lollms that implements authentication for Socket.IO events.", "Add authentication or authorization checks to the event handlers in lollms_generation_events.py to restrict access to trusted users.", "Restrict Socket.IO connections to trusted IP addresses or networks by configuring firewalls or network segmentation to reduce the number of clients that can reach the vulnerable endpoints."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affected by version 5.9.0 of the lollms project maintained by parisneo. The vulnerability resides specifically in the lollms_generation_events.py file and can be exploited on any instance running that version.", "description_and_impact": "The vulnerability exists in lollms_generation_events.py of parisneo/lollms version 5.9.0. Event handlers such as generate_text, cancel_generation, generate_msg, and generate_msg_from are registered without any authentication or authorization checks. This lets anyone who can connect to the Socket.IO interface invoke these operations, which are resource\u2011intensive and may alter server state. As a result, an attacker can consume resources, cause a denial of service, corrupt internal state, or trigger race conditions that affect other clients.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity, but the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw simply by connecting to the Socket.IO endpoint without authentication, so the risk remains significant for exposed deployments. Organizations with publicly reachable lollms services should treat this vulnerability as high risk and act quickly."}}}}, "created": "2026-02-04T12:44:46.952352+00:00", "updated": "2026-04-18T00:45:32.242557+00:00", "vendors": ["parisneo", "parisneo$PRODUCT$lollms"]}