CVE-2024-11302

A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value.

A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /install_binding and /reinstall_binding endpoints, among others, enabling unauthorized access and manipulation of binding settings without requiring the client_id value.

La falta de la función check_access() en el módulo lollms_binding_infos del repositorio parisneo/lollms (versión V14) permite a los atacantes añadir, modificar y eliminar enlaces arbitrariamente. Esta vulnerabilidad afecta a los endpoints /install_binding y /reinstall_binding, entre otros, lo que permite el acceso no autorizado y la manipulación de la configuración de enlaces sin necesidad del valor client_id.