uselotus vulnerabilities

Products

• uselotus/lotus 6

Latest uselotus CVEs

Newest publication first

1. CVE-2026-115334 Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

   Published 2026-10-22

   High·CVSS 7.6 EPSS 0.35%

   Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/sw...

2. CVE-2026-115333 Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix

   Published 2026-10-22

   High·CVSS 8.2 EPSS 0.36%

   Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to...

3. CVE-2026-115332 Lotus through 0.10.2 SQL Injection via Subscription Filter Keys

   Published 2026-10-22

   High·CVSS 8.7 EPSS 0.45%

   Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is render...

4. CVE-2026-115331 Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters

   Published 2026-10-22

   High·CVSS 8.7 EPSS 0.42%

   Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated count...

5. CVE-2026-115330 Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

   Published 2026-10-22

   High·CVSS 8.7 EPSS 0.44%

   Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-st...

6. CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet

   Published 2026-10-22

   Medium·CVSS 6.0 EPSS 0.26%

   Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organiz...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.