CVE-2026-115332: Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscriptionfilterkeys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Affected Software
Event History
Frequently Asked Questions
Which Lotus versions are affected?
Lotus versions through 0.10.2 are affected.
What level of access does an attacker need?
An attacker needs an authenticated organization-user account and the ability to create a subscription with crafted subscription_filter_keys.
What systems and data are exposed by exploitation?
The injected SQL is executed in usage aggregation queries against the shared multi-tenant database, with potential impact to confidentiality, integrity, and availability.