CVE-2026-115329: Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscriptionid to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker needs valid authentication as a user or API key belonging to any organization and a subscription_id for another organization. No user interaction is required.
What can an attacker do with another organization's subscription ID?
They can read the subscription and perform billing-related actions including cancellation, updates, plan switches, and addon modifications. This can expose subscription information and alter another tenant's billing.