CVE-2026-115334: fallo de gravedad alta en uselotus lotus
Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.6epss 0.4%
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
uselotus · lotusCVEs relacionadas — uselotus lotus
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-115332HIGHLotus through 0.10.2 SQL Injection via Subscription Filter KeysEPSS 0.4%CVE-2026-115330HIGHLotus through 0.10.2 SQL Injection via Custom SQL Billable MetricsEPSS 0.4%CVE-2026-115331HIGHLotus through 0.10.2 SQL Injection via Metric Property Names and FiltersEPSS 0.4%CVE-2026-115333HIGHLotus through 0.10.2 Improper Authentication via Event Ingestion API Key PrefixEPSS 0.4%CVE-2026-115329MEDIUMLotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSetEPSS 0.3%