SQL Injection Vulnerability in Lotus by UsLotus

CVE-2026-115331

What is CVE-2026-115331?

Lotus versions up to 0.10.2 are susceptible to an SQL injection vulnerability that permits authenticated users to manipulate SQL queries. By providing specially crafted values for the billable metric property_name or applying categorical filter variables, attackers can inject SQL code. This SQL code can then be rendered unescaped into Jinja-generated queries, enabling unauthorized access to shared databases used by multiple tenants. Such vulnerabilities can pose significant security risks, potentially exposing sensitive data and compromising the integrity of the application.

References