CVE-2026-115334
CVE-2026-115334 · Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
CVSS 7.6 · High · EPSS 0.2%
- Published
- Updated
Affected products and versions
lotus
- Versions
- ≥ 0, ≤ 0.10.2: Affected (semver)
No fix published
Original sources
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340
- https://github.com/uselotus/lotus
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-organization-endpoint
- https://nvd.nist.gov/vuln/detail/CVE-2026-115334