GHSA-82fw-ch24-j34w

Source

https://github.com/advisories/GHSA-82fw-ch24-j34w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-82fw-ch24-j34w/GHSA-82fw-ch24-j34w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-82fw-ch24-j34w

Aliases

CVE-2026-1117

Published

2026-02-02T12:31:14Z

Modified

2026-02-03T17:52:12.816997Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H CVSS Calculator

Summary

Lollms has an Improper Access Control vulnerability

Details

A vulnerability in the lollms_generation_events.py component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The add_events function registers event handlers such as generate_text, cancel_generation, generate_msg, and generate_msg_from without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (lollmsElfServer.busy, lollmsElfServer.cancel_gen) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.

Database specific

{
    "cwe_ids": [
        "CWE-284"
    ],
    "github_reviewed_at": "2026-02-02T21:56:51Z",
    "nvd_published_at": "2026-02-02T10:16:06Z",
    "severity": "HIGH",
    "github_reviewed": true
}

References

Affected packages

PyPI / lollms

Package

Name: lollms; View open source insights on deps.dev
Purl: pkg:pypi/lollms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.0

Affected versions

1.*

1.1.3

1.1.5

1.1.6

1.1.7

1.1.9

1.1.10

1.1.11

1.1.12

1.1.13

1.1.14

1.1.15

1.1.16

1.1.17

1.1.18

1.1.19

1.1.20

1.1.21

1.1.22

1.1.25

1.1.26

1.1.27

1.1.28

1.1.29

1.1.30

1.1.31

1.1.32

1.1.33

1.1.34

1.1.35

1.1.36

1.1.37

1.1.38

1.1.45

1.1.46

1.1.47

1.1.48

1.1.49

1.1.50

1.1.51

1.1.52

1.1.53

1.1.55

1.1.56

1.1.57

1.1.58

1.1.59

1.1.60

1.1.61

1.1.62

1.1.63

1.1.64

1.1.65

1.1.66

1.1.67

1.1.68

1.1.69

1.1.70

1.1.71

1.1.73

1.1.74

1.1.75

1.1.76

1.1.77

1.1.78

1.1.79

1.1.80

1.1.82

1.1.83

1.1.84

1.1.85

1.1.86

1.1.90

1.1.91

1.1.92

1.2.0

1.2.1

1.2.3

1.2.4

1.2.6

1.2.7

1.2.8

1.2.9

1.2.10

1.2.11

1.2.12

1.2.14

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.26

2.0.27

2.0.28

2.0.30

2.0.31

2.0.32

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-82fw-ch24-j34w/GHSA-82fw-ch24-j34w.json"