CVE-2026-115332 — Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypa…
Published: 2026-10-22 · CVSS: 8.7 · CVSS 4.0
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7