CVE-2026-115329

Medium

Description

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.

SeverityMedium

CVSS5.9

Exploit probability—

ProductLotus

PublishedOct 22, 2026

First seenOct 22, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/uselotus/lotus/pull/802
github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96

Affected products

Product	Affected versions	Fixed in
uselotus lotus	v ≤ 0.10.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.