CVE-2026-115329
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
52/100
Published: 2026-10-22
Modified: 2026-10-23
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
X
AT:
Present
VC:
Low
VI:
High
VA:
None
Description
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.