Threats affecting pkg:github/lago

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

Lago versions up to 1.55.0 have an authentication bypass vulnerability in the acceptInvite mutation. This flaw allows organization administrators to obtain session tokens for existing accounts without password verification. Exploitation enables attackers to access sensitive organizational data including billing, API keys, and payment integrations by inviting a victim's email and accepting with any password.