CVE-2026-115334

Name of the Vulnerable Software and Affected Versions Lotus versions prior to 0.10.3

Description An authorization bypass exists in the ChangeUserOrganizationView.post function. Authenticated users can join any organization by providing its UUID. An attacker can send a POST request to the '/app/switch organization/' endpoint to gain unauthorized access to another tenant's data and billing configuration.

Recommendations Update Lotus to version 0.10.3 or later. As a temporary mitigation, restrict access to the '/app/switch organization/' endpoint.