CVE-2026-115329

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.