{"cve":"CVE-2026-1117","nvd":{"published":"2026-02-02T10:16:06.500","modified":"2026-06-17T10:15:07.057","status":"Deferred","description":"A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","score":8.2},"cwes":["CWE-284"],"references":["https://github.com/parisneo/lollms/commit/36a5b513dfefe9c2913bf9b618457b4fea603e3b","https://huntr.com/bounties/d2846a7f-0140-4105-b1bb-5ef64ec8b829"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:22:27.261130201+00:00"},"epss":{"cve":"CVE-2026-1117","score":0.00585,"percentile":0.47981,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-82fw-ch24-j34w","url":"https://osv.dev/vulnerability/GHSA-82fw-ch24-j34w","summary":"Lollms has an Improper Access Control vulnerability","modified":"2026-07-07T17:56:07.973264947Z","packages":[{"ecosystem":"PyPI","name":"lollms","purl":"pkg:pypi/lollms","ranges":["<2.1.0"],"fixed":["2.1.0"]}]},{"id":"PYSEC-2026-1586","url":"https://osv.dev/vulnerability/PYSEC-2026-1586","summary":"Lollms has an Improper Access Control vulnerability","modified":"2026-07-07T17:46:17.311777356Z","packages":[{"ecosystem":"PyPI","name":"lollms","purl":"pkg:pypi/lollms","ranges":["<2.1.0"],"fixed":["2.1.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}