Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

Advisories

Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

Severity: medium
Date: 10/22/2026
Affecting: lotus <= 0.10.2
CVE: CVE-2026-115329
CWE: CWE-639 Authorization Bypass Through User-Controlled Key
CVSS: 6.0
CVSS V4 Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://github.com/uselotus/lotus/issues/799
https://github.com/uselotus/lotus/pull/802
https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96
https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754
https://github.com/uselotus/lotus
Credit: lighthousekeeper1212 (Lighthouse Research Project), leediay153 from Viettel Post
Description: Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo