uselotus Lotus CVE-2026-115333

Exploitation requires the attacker to know or obtain a valid API key prefix for a target organization; the secret portion is never checked against the stored hashed_key, so the full key is not needed. The defect is in the Go event-ingestion authentication middleware (authn.go) in Lotus versions through 0.10.2, reached via the POST /api/track/ endpoint. The limiting factor - reflected by CVSS AC:H/AT:P - is acquiring that prefix; the sources do not describe how a prefix would be enumerated or leaked. No special configuration is stated as required, and no fixed version is provided in the available sources.

This is a genuine integrity-focused authentication flaw (CWE-287) rather than a high-CVSS-but-low-real-risk issue, but its blast radius is narrow. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) scores 8.2 and models the vulnerability accurately: it is network-reachable and requires no valid credentials (PR:N), because the event-ingestion middleware checks only the API key prefix and never verifies the secret against the stored hashed_key. The AC:H and AT:P metrics correctly reflect that exploitation is gated on the attacker first knowing or obtaining a target organization's key prefix - the vulnerable flaw does not describe how a prefix would be enumerated, so this is a real precondition, not a trivially-met one. Impact is isolated to integrity (VI:H, with VC:N/VA:N): forged usage events corrupt metered usage and billing, with no confidentiality or availability consequence. The vuln.today Decision label is 'this_week' (not act_now/emergency). No EPSS score and no KEV status are present in the input, so exploitation probability cannot be quantified and there is no evidence of active exploitation; the report is from VulnCheck. A public PoC reference (hackmd write-up) is linked but is not verified as working exploit code. Signals are therefore consistent rather than conflicting: a verifiable, unauthenticated integrity defect with a real prefix-knowledge precondition, in a niche product, warranting prompt but not emergency remediation.

An attacker who has learned a target organization's API key prefix (for example from a leaked, truncated, or logged key) sends crafted usage events to POST /api/track/. The event-ingestion middleware accepts them because it validates only the prefix and not the secret, letting the attacker inflate or alter that organization's metered usage and billing. A public PoC reference (hackmd) exists but is not verified as working exploit code; CVSS AC:H/AT:P indicates obtaining the prefix is the main barrier.