CVE-2026-115330

Publié : 22 octobre 2026

Modifié : 22 octobre 2026

Score CVSS

8.8

HIGH

Description détaillée

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/uselotus/lotus https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656 https://hackmd.io/@leediay/BkUc3WL2Mx https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics

Dernières Vulnérabilités

CVE-2026-13411

Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which allows an authenticated attacker to crash the Playbooks plugin instance-wide via a crafted import request containing a null condition. Mattermost Advisory ID: MMSA-2026-00709

VOIR DÉTAILS

CVE-2026-115334

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

VOIR DÉTAILS

CVE-2026-115333

Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.

VOIR DÉTAILS