HIGH 7.6 NVD
CVE-2026-115334
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
References
- https://github.com/uselotus/lotus
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326
- https://hackmd.io/@leediay/BkUc3WL2Mx
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-authorization-bypass-via-switch-
This high severity vulnerability with a CVSS score of 7.6 was published on 2026-10-22 via NVD.
vulnfeed aggregates 17299 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.