diff --git src/bp-templates/bp-legacy/buddypress-functions.php src/bp-templates/bp-legacy/buddypress-functions.php
index 08feb6d2c..6de3af338 100644
--- src/bp-templates/bp-legacy/buddypress-functions.php
+++ src/bp-templates/bp-legacy/buddypress-functions.php
@@ -1395,6 +1395,11 @@ function bp_legacy_theme_ajax_addremove_friend() {
 	// Cast fid as an integer.
 	$friend_id = (int) $_POST['fid'];
 
+	$user = get_user_by( 'id', $friend_id );
+	if ( ! $user ) {
+		die( __( 'Not a valid user.', 'buddypress' ) );
+	}
+
 	// Trying to cancel friendship.
 	if ( 'is_friend' == BP_Friends_Friendship::check_is_friend( bp_loggedin_user_id(), $friend_id ) ) {
 		check_ajax_referer( 'friends_remove_friend' );
diff --git src/bp-templates/bp-nouveau/includes/friends/ajax.php src/bp-templates/bp-nouveau/includes/friends/ajax.php
index 083ae94c4..44aee7166 100644
--- src/bp-templates/bp-nouveau/includes/friends/ajax.php
+++ src/bp-templates/bp-nouveau/includes/friends/ajax.php
@@ -88,6 +88,18 @@ function bp_nouveau_ajax_addremove_friend() {
 	// Cast fid as an integer.
 	$friend_id = (int) $_POST['item_id'];
 
+	$user = get_user_by( 'id', $friend_id );
+	if ( ! $user ) {
+		wp_send_json_error(
+			array(
+				'feedback' => sprintf(
+					'<div class="bp-feedback error">%s</div>',
+					esc_html__( 'Not a valid user.', 'buddypress' )
+				),
+			)
+		);
+	}
+
 	// In the 2 first cases the $friend_id is a friendship id.
 	if ( ! empty( $_POST['action'] ) && 'friends_accept_friendship' === $_POST['action'] ) {
 		if ( ! friends_accept_friendship( $friend_id ) ) {