Insecure Direct Object Reference Vulnerability in Lotus by UseloTus
CVE-2026-115329

6MEDIUM

Key Information:

Vendor

Uselotus

Status
Lotus
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115329?

The Lotus application, up to version 0.10.2, is susceptible to an insecure direct object reference vulnerability that occurs in the SubscriptionViewSet.get_object() method. This issue arises due to the use of an unscoped queryset that lacks proper organization filtering and permission checks. As a result, authenticated users or those with API keys can manipulate the subscription_id of different organizations to access, alter, or delete subscriptions, effectively compromising the integrity of billing and subscription management across different tenants. Immediate action is recommended to ensure the protection of sensitive data and compliance with security best practices.

Affected Version(s)

lotus 0 <= 0.10.2

References

https://github.com/uselotus/lotus/issues/799
issue-tracking
https://github.com/uselotus/lotus/pull/802
patchissue-tracking
https://github.com/uselotus/lotus/commit/1375d5140795d722...
patch

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lighthousekeeper1212 (Lighthouse Research Project)
leediay153 from Viettel Post
.