CVE-2026-40305 is an improper authorization vulnerability (CWE-285) in the DNN Platform's friends feature affecting versions >= 6.0.0 and < 10.2.2. An authenticated user with low privileges can manipulate requests to cause another user's friend request to be accepted without their authorization. This could lead to unauthorized social connections being established within the platform. The vulnerability is fixed in version 10.2.2. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and limited impact on confidentiality only.

The vulnerability allows an attacker with some privileges to force acceptance of friend requests on behalf of other users, potentially violating user privacy and trust within the platform. There is no direct impact on data integrity, availability, or broader system confidentiality. No known exploits are reported in the wild.

Upgrade affected DNN Platform installations to version 10.2.2 or later, where this improper authorization issue is patched. Since the vendor advisory indicates the issue is fixed in 10.2.2, applying this official fix fully mitigates the vulnerability. No additional mitigations are specified or required.