CVE-2026-115334: Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/ to access that tenant's data and billing configuration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated Lotus account. The description specifically notes that self-registered users can exploit the issue if they know the UUID of another organization.
What information does an attacker need?
The attacker must know a target organization's UUID and can submit it in a POST request to /app/switch_organization/. The attack complexity is rated high, consistent with the need to obtain that identifier.
What access could an attacker gain?
The attacker can join the target organization and access that tenant's data and billing configuration. Confidentiality and integrity impacts are rated high, while availability impact is rated none.
Are deployments affected by default?
The available information identifies Lotus through version 0.10.2 as affected and does not state that any non-default configuration is required. Exposure depends on an attacker being able to authenticate and obtain another organization's UUID.