CVE-2026-115332

Name of the Vulnerable Software and Affected Versions Lotus versions prior to 0.10.3

Description Authenticated organization users can perform SQL injection by registering crafted subscription filter keys that bypass keyword-only validation. The malicious key is rendered as an unquoted group-by identifier, allowing the injection of SQL into usage aggregation queries within the shared multi-tenant database.

Recommendations Update Lotus to version 0.10.3 or later. As a temporary mitigation, restrict the ability of users to register new subscription filter keys until the update is applied.