Lotus CVE-2026-115331

Requires a valid authenticated account on a Lotus organization/tenant with the ability to create or configure billable metrics (PR:L); the attacker supplies a malicious billable-metric property_name or categorical filter value, which Lotus renders unescaped into Jinja-generated counter, gauge or rate metric SQL queries. No user interaction by a victim is needed (UI:N). The principal limiting factors are that the attacker must already hold an authenticated organization-user account and must be able to reach the metric-definition functionality; the cross-tenant impact specifically presumes a shared-database multi-tenant deployment, which the description states is the affected configuration.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.7) describes a network-reachable, low-complexity SQL injection that requires low-level privileges (PR:L) - i.e., an authenticated organization user - and yields high confidentiality, integrity and availability impact on the backing database. The most significant contextual amplifier is architectural: the description states the shared database serves all tenants, so a single authenticated tenant can read or alter data belonging to every other tenant, making this effectively a cross-tenant isolation break rather than a self-scoped issue. Against these severity signals, exploitation-likelihood signals are thin and partly missing: there is no CISA KEV listing and no EPSS score in the input, so widespread or automated exploitation cannot be asserted. A public PoC reference exists (the hackmd write-up and the referenced source line), but it is not verified as working exploit code. The vuln.today decision label is 'this_week' - elevated but below act_now/emergency - which aligns with a serious, reported flaw that is not yet shown to be actively exploited at scale. Net: a genuinely high-severity, high-confidence vulnerability for anyone running Lotus multi-tenant, but real-world urgency is tempered by the authentication requirement and the product's limited deployment footprint rather than by any contradiction in the data.

An authenticated low-privilege user of one organization on a multi-tenant Lotus deployment creates or edits a billable metric (counter, gauge or rate), supplying a crafted property_name or categorical filter value that embeds SQL. Because the value is rendered unescaped into the Jinja-generated metric query, the injected SQL executes against the shared database and lets the attacker read or manipulate other tenants' billing data. A public PoC reference exists; it is not verified as working exploit code.