CVE-2026-115329: Authorization Bypass Through User-Controlled Key in uselotus lotus

The vulnerability in uselotus lotus (<=0.10.2) is due to an insecure direct object reference in the SubscriptionViewSet.get_object() method. The method uses an unscoped queryset that does not filter by organization or enforce permission checks. Consequently, authenticated users or API keys from one organization can supply another organization's subscription_id and perform unauthorized actions on that subscription, such as reading details, canceling, updating, switching plans, or modifying addons. This flaw compromises tenant isolation in a multi-tenant billing context.

An attacker with valid authentication or API access from any organization can manipulate subscription data of other organizations. This includes unauthorized reading of subscription details and modifying billing-related actions such as canceling subscriptions, changing plans, or altering addons. This can lead to unauthorized access to sensitive billing information and disruption of other tenants' subscription services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the SubscriptionViewSet API to trusted users and monitor for unusual subscription modification activity. Implement additional access controls or custom permission checks to enforce organization scoping on subscription queries.