Threat Intelligence Database

Lotus versions up to 0.10.2 have an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization. This allows attackers who self-register and know another organization's UUID to access that organization's tenant data and billing configuration.

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

Lotus versions up to 0.10.2 have a SQL injection vulnerability that allows authenticated organization users to inject SQL commands via crafted billable metric property_name or categorical filter values. This injection occurs because these values are rendered unescaped into Jinja-generated metric queries, potentially exposing the shared database to unauthorized access.

Lotus versions up to 0.10.2 have an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL commands by appending stacked statements to custom metric queries. This occurs because the application accepts semicolon-separated SQL statements via POST /app/metrics/ and bypasses validation that only checks the first statement. This vulnerability can lead to unauthorized reading or modification of data across all tenants.

CVE-2026-115329 is an authorization bypass vulnerability in the uselotus lotus product up to version 0.10.2. It arises from an insecure direct object reference in the SubscriptionViewSet.get_object() method, which uses an unscoped queryset lacking organization filtering or permission checks. This allows authenticated users or API keys from any organization to access and modify subscription data belonging to other organizations, including reading, canceling, updating, switching plans, or modifying addons.