Lotus CVE-2026-115334

Exploitation requires three concrete prerequisites: (1) a valid authenticated Lotus account, obtainable via self-registration, satisfying PR:L; (2) knowledge of the target organization's UUID, which is a random, non-guessable value that must be leaked or otherwise obtained out-of-band - this is the condition behind AC:H/AT:P and the primary limiting factor; and (3) network reachability of the ChangeUserOrganizationView endpoint at /app/switch_organization/. There is no user-interaction requirement (UI:N). The practical limit on exploitation is therefore not authentication (self-registration is trivial) but obtaining the victim tenant's UUID; without it the attacker cannot select which organization to join.

This is a genuine but not drop-everything priority. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:N) and the 7.6 score describe a network-reachable flaw with high confidentiality and integrity impact (VC:H/VI:H) but no availability impact, requiring an authenticated low-privilege account (PR:L) - satisfiable because Lotus allows self-registration. The AC:H and AT:P metrics reflect a real brake on mass exploitation: the attacker must know the victim organization's UUID, a 122-bit random value that is not under attacker control and not guessable, so this is not trivially automatable across the internet. No EPSS score and no KEV listing were supplied, so there is no quantified exploitation-probability signal and no evidence of active exploitation; the only exploitation-maturity signal is the vuln.today Decision label 'this_week' and a public PoC write-up reference. These signals are consistent - a serious multi-tenant data/billing exposure that warrants prompt patching but is gated by needing both an account and the target UUID, pointing to targeted rather than opportunistic abuse. Verify EPSS/KEV independently, as both are absent from the provided data.

An attacker self-registers a normal account on a Lotus instance, then - having learned another tenant's organization UUID (for example from a leaked URL, API response, or shared link) - sends a POST request to /app/switch_organization/ supplying that UUID, and is switched into the victim tenant with access to its data and billing configuration. A public PoC write-up reference exists (hackmd) but is not verified as working exploit code. The network attack vector is offset by the need for a valid account (PR:L) and knowledge of the non-guessable target UUID (AC:H/AT:P).