Parisneo Lollms Arbitrary Binding Manipulation Vulnerability in Lollms Binding Infos Module

A vulnerability in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to arbitrarily add, modify, and remove bindings. This issue arises from a missing access check in the binding management endpoints, enabling unauthorized manipulation of binding settings without the need for a client_id.

Impact

Exploitation of this vulnerability could lead to unauthorized access and manipulation of binding settings, allowing attackers to disrupt or alter the functionality of the application by mismanaging bindings.