PT-2026-5648 · Parisneo · Lollms

Published

2026-02-02

·

Updated

2026-02-02

·

CVE-2026-1117

CVSS v3.1

8.2

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Name of the Vulnerable Software and Affected Versions parisneo/lollms version 5.9.0
Description A flaw exists in the lollms generation events.py component that permits unauthenticated access to sensitive Socket.IO events. The add events function registers event handlers – generate text, cancel generation, generate msg, and generate msg from – without authentication or authorization. This allows unauthenticated clients to perform resource-intensive operations or alter the system's state, potentially leading to denial of service, state corruption, and race conditions. The use of global flags (lollmsElfServer.busy, lollmsElfServer.cancel gen) for state management in a multi-client environment introduces further risks, enabling one client to impact the server's state and other clients.
Recommendations versions prior to 5.9.0 are not affected. Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disabling the vulnerable component lollms generation events.py until a patch is available.

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-1117
GHSA-82FW-CH24-J34W

Affected Products

Lollms