CVE-2026-115333

Name of the Vulnerable Software and Affected Versions Lotus versions prior to 0.10.3

Description Improper authentication exists in the Go event ingestion middleware. The system validates API keys using only the prefix and fails to verify the secret against the stored hashed key. This allows an attacker with knowledge of an API key prefix to submit usage events to the 'POST /api/track/' endpoint, enabling them to impersonate an organization and manipulate its metered usage and billing.

Recommendations Update Lotus to version 0.10.3 or later. Restrict access to the 'POST /api/track/' endpoint to minimize the risk of unauthorized event submission.