Authorization Bypass Vulnerability in Lotus by UseloTUS
CVE-2026-115334

7.6HIGH

Key Information:

Vendor

Uselotus

Status
Lotus
Vendor
CVE Published:
22 October 2026

What is CVE-2026-115334?

Lotus versions up to 0.10.2 are susceptible to an authorization bypass vulnerability in the ChangeUserOrganizationView.post function. This flaw enables authenticated users to manipulate their organization affiliations by simply supplying the UUID of any organization. Consequently, attackers who can self-register and possess knowledge of another organization’s UUID can exploit this weakness to execute a POST request to /app/switch_organization/, granting them unauthorized access to sensitive tenant data and billing configurations.

Affected Version(s)

lotus 0 <= 0.10.2

References

https://hackmd.io/@leediay/BkUc3WL2Mx
technical-description
https://github.com/uselotus/lotus/blob/0.10.2/backend/met...
technical-description
https://github.com/uselotus/lotus
product

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

leediay153 from Viettel Post
.