Lotus CVE-2026-115329

The attacker must hold valid authentication on the Lotus instance - an authenticated user account OR a valid API key from ANY organization (PR:L); this is a default code path in SubscriptionViewSet.get_object(), not a feature that must be enabled, so no special configuration is required. The practical limiting factor is that the attacker must know or enumerate the target organization's subscription_record_id, which is a UUID and therefore not readily guessable. Exploitation is cross-tenant and only meaningful on multi-organization (shared or self-hosted multi-tenant) deployments of Lotus through 0.10.2; a single-tenant deployment has no other organization to target. No user interaction is required.

Signals are mixed and point to a moderate, not urgent, priority. The input CVSS 4.0 base is 6.0 (Medium): AV:N and UI:N make it remotely reachable, but PR:L means a valid account or API key is required, and the vendor marked AC:H/AT:P - however the description gives no mechanism (no race, timing, or attacker-uncontrolled precondition is stated) to justify high complexity; it describes a plain identifier substitution, so AC:H/AT:P appears over-stated and the practical complexity is low. There is no EPSS score in the input, the CVE is not in CISA KEV, and no working exploit code is identified, so this is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a real-but-schedulable issue. The strongest aggravating factor is impact: cross-tenant VI:H means an attacker in one organization can alter another tenant's billing (cancel, update, switch plans, modify addons). The strongest mitigating factors are that the product (uselotus Lotus) has a small real-world footprint and exploitation requires both authentication and knowledge of another organization's subscription UUID. Net: patch on a normal cycle (this month) rather than as an emergency.

An authenticated user or API-key holder belonging to one tenant organization on a shared/self-hosted Lotus instance sends a request to the subscription endpoint supplying another organization's subscription_record_id (a UUID). Because SubscriptionViewSet.get_object() queries an unscoped queryset with no organization filter or permission check, the request succeeds and lets the attacker read, cancel, update, switch plans, or modify addons on the victim tenant's subscription. No public exploit is identified, but the vulnerable line and the one-line fix are public in PR #802.