CVE-2026-40305 is an improper authorization vulnerability (CWE-285) in the DNN Platform's friends feature affecting versions >= 6.0.0 and < 10.2.2. It permits a user to manipulate requests to cause acceptance of friend requests on behalf of other users without proper authorization checks. This could lead to unauthorized social connections being established within the platform. The vulnerability is fixed in version 10.2.2. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and limited confidentiality impact.

An attacker with low privileges can cause friend requests to be accepted on behalf of other users without their consent, potentially altering social relationships within the platform. There is no direct impact on data confidentiality, integrity, or availability beyond this unauthorized action. No known exploitation in the wild has been reported.

Upgrade affected DNN Platform installations to version 10.2.2 or later, where this improper authorization vulnerability is patched. Since no official remediation level or patch links are provided beyond the version update, applying this version upgrade is the recommended mitigation. Monitor vendor advisories for any additional guidance.