In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victims machine.
The product implements an authentication technique, but it skips a step that weakens the technique.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lollms_web_ui | Lollms | 9.8 (including) | 9.8 (including) |