Lotus CVE-2026-115330

Requires a valid authenticated organization-level user account on the Lotus instance (PR:L) and access to the custom billable-metric query feature; the attacker supplies semicolon-separated, stacked SQL statements through POST /app/metrics/. The specific weakness is that input validation enforces only a first-statement-only check, so any statements appended after the first semicolon execute unfiltered against the shared multi-tenant database. Limiting factors: exploitation is gated by authentication (an attacker must already be a legitimate tenant user, not an anonymous visitor), and it depends on reaching the custom-SQL metric functionality rather than a default unauthenticated surface. No special non-default configuration or user interaction is indicated.

Signals are largely consistent and point to a genuine but access-gated priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nevertheless requires an authenticated organization-level account (PR:L), and all three vulnerable-system impacts are High (VC:H/VI:H/VA:H) because stacked SQL permits reading and modifying data across all tenants. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with a serious flaw that still depends on a valid tenant login. This is NOT a wormable unauthenticated RCE, but a multi-tenant SQL injection that lets any legitimate organization user pivot across tenant boundaries - a high-impact confidentiality/integrity break for a SaaS billing platform. Key missing signals: no EPSS score is provided and the product is not on CISA KEV, so there is no probabilistic or confirmed-exploitation data; exploitation status rests only on PoC-style references. EPSS/KEV absence here is expected for a niche product and does not lower the technical severity. No signals conflict with one another.

An attacker who holds (or registers/obtains) a legitimate organization user account logs into a Lotus instance and uses the custom billable-metric feature to submit a crafted query containing semicolon-separated SQL. Because validation only inspects the first statement, the appended stacked statements execute, letting the attacker read or alter billing and customer data belonging to other tenants. A public PoC reference (a HackMD write-up and the exact vulnerable source location) exists; it is not verified as working exploit code.