CVE-2026-115329
CVE-2026-115329 · Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
CVSS 6.0 · Media · EPSS 0,3%
- Publicación
- Actualización
Productos y versiones afectados
lotus
- Versiones
- ≥ 0, ≤ 0.10.2: Afectada (semver)
Sin corrección publicada
Fuentes originales
- https://github.com/uselotus/lotus/issues/799
- https://github.com/uselotus/lotus/pull/802
- https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96
- https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754
- https://github.com/uselotus/lotus
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-cross-organization-idor-via-subscriptionviewset
- https://nvd.nist.gov/vuln/detail/CVE-2026-115329