CVE-2026-115329 — Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering…
Published: 2026-10-22 · CVSS: 6.0 · CVSS 4.0
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7