CVE-2026-115334 — Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its …
Published: 2026-10-22 · CVSS: 7.6 · CVSS 4.0
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7