CVE-2026-115329

Name of the Vulnerable Software and Affected Versions Lotus versions prior to 0.10.3

Description An insecure direct object reference occurs in the get object() function within the SubscriptionViewSet. The issue stems from the use of an unscoped queryset that lacks organization filtering or permission checks. Consequently, authenticated users or those with API keys from any organization can provide a subscription id belonging to another organization to read, cancel, update, switch plans, or modify addons, which allows for the alteration of another tenant's billing.

Recommendations Update Lotus to version 0.10.3 or later. As a temporary mitigation, restrict access to the SubscriptionViewSet or the get object() function to ensure organization-level filtering is enforced.