Threat database

Lotus versions up to 0.10.2 have an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization. This allows attackers who self-register and know another organization's UUID to access that organization's tenant data and billing configuration.

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.

Lotus versions up to 0.10.2 have a SQL injection vulnerability that allows authenticated organization users to inject SQL commands via crafted billable metric property_name or categorical filter values. This injection occurs because these values are rendered unescaped into Jinja-generated metric queries, potentially exposing the shared database to unauthorized access.

Lotus versions up to 0.10.2 have an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL commands by appending stacked statements to custom metric queries. This occurs because the application accepts semicolon-separated SQL statements via POST /app/metrics/ and bypasses validation that only checks the first statement. This vulnerability can lead to unauthorized reading or modification of data across all tenants.

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.