CVE-2026-115330: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Lotus organization user can exploit it. The attack is network-accessible and does not require user interaction.
What access does an attacker need to execute arbitrary SQL?
The attacker needs an authenticated organization-user account and the ability to submit custom metric queries to POST /app/metrics/. They can append semicolon-separated statements to bypass validation that checks only the first statement.
What is the potential impact beyond the attacker's own organization?
The issue can allow reading or modifying data across all tenants. Its stated impact includes high confidentiality, integrity, and availability consequences.
Are versions after 0.10.2 confirmed to be affected?
The provided information confirms Lotus through version 0.10.2 as affected. It does not establish whether later versions are affected or fixed.