CVE-2026-115330

Name of the Vulnerable Software and Affected Versions Lotus versions prior to 0.10.3

Description Authenticated organization users can execute arbitrary SQL by appending stacked statements to custom metric queries. This occurs when semicolon-separated SQL is submitted through the 'POST /app/metrics/' endpoint, which bypasses the validation intended to allow only the first statement. This flaw allows attackers to read or modify data across all tenants.

Recommendations Update to a version newer than 0.10.2. Restrict access to the 'POST /app/metrics/' endpoint to minimize the risk of exploitation.