Authorization Bypass in Lago Invoice Processing by GetLago

CVE-2026-119548

What is CVE-2026-119548?

Lago versions up to 1.55.0 are susceptible to an authorization bypass vulnerability within the Invoices::Payments::StripeService module. This issue allows users from one organization to incorrectly mark invoices from another organization as paid. The flaw arises from an unscoped lookup mechanism for invoices, enabling attackers with control over their organization’s Stripe integration to exploit the system. By forging a payment_intent.succeeded event that references a victim invoice UUID, attackers can potentially unlock access to unauthorized wallet top-ups or subscriptions that are otherwise payment-gated.

References