CVE-2026-115332
HighCVSS 8.8Summary
Lotus through 0.10.2 contains an SQL injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Risk Assessment
An authenticated organization user can inject SQL into the shared multi-tenant database, potentially disclosing or modifying other tenants' data. A valid organization account is required.
Recommendation
Upgrade Lotus beyond 0.10.2 once the vendor provides a fix. Until then, restrict subscription creation and monitor for unusual subscription_filter_keys values.
Other vulnerabilities in Lotus
See all- CVE-2026-115334Medium
Lotus through 0.10.2 contains an authorization bypass in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
- CVE-2026-115333Medium
Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. Attackers who know or obtain an API key prefix can submit usage events to POST /api/track/ as that organization, altering its metered usage and billing.
- CVE-2026-115331High
Lotus through 0.10.2 contains an SQL injection vulnerability that allows authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. Attackers can embed SQL in values rendered unescaped into Jinja-generated counter, gauge and rate metric queries to access the database shared by all tenants.
- CVE-2026-115330High
Lotus through 0.10.2 contains an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
- CVE-2026-115329Medium
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
Original NVD description (English source)
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS