EUVD-2026-108134
GHSA-fcf4-2wr8-2h4q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as organization user
-
ExploitRegister crafted subscription_filter_key bypassing validation
-
ExecutionCreate subscription injecting SQL into group-by
-
ImpactExfiltrate cross-tenant data from shared database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated organization-level user account on a multi-tenant Lotus deployment at version 0.10.2 or earlier (PR:L). The attacker must register a subscription_filter_key crafted to satisfy the keyword-only validation yet contain SQL, and then create a subscription referencing that key so it is rendered as an unquoted group-by identifier inside the usage-aggregation query path. Limiting factors: valid authenticated org credentials are needed (not anonymous/unauthenticated), the deployment must use the shared multi-tenant database model where aggregation queries span tenants, and impact beyond data disclosure is constrained by the single-statement query context of the underlying Django/psycopg2 driver. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7 'High') describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction - a realistic profile for an insider or a compromised/registered tenant account in a SaaS billing deployment. The vendor (VulnCheck) rates vulnerable-system confidentiality, integrity and availability all High; however, because the described mechanism is an unquoted group-by identifier injected into SELECT-based usage-aggregation queries, I judge the integrity and availability impact to be weaker in practice than VC:H/VI:H/VA:H implies, since stacked/multi-statement queries are typically disabled by the Django/psycopg2 stack this project uses - the dominant, clearly-supported impact is confidentiality (cross-tenant data disclosure from the shared multi-tenant database). No EPSS score is provided in the input, so probabilistic exploitation likelihood cannot be stated. The vulnerability is NOT in CISA KEV and there is no confirmed active exploitation; a public PoC/write-up reference exists but is not verified as working exploit code. The vuln.today decision label is 'this_week' (not act_now/emergency). Net: this is a genuine, authenticated multi-tenant SQL injection worth prioritizing within the week for anyone running Lotus, but the low real-world footprint of the product and the requirement for an authenticated org account temper it below an internet-wide emergency. |
| Exploit ScenarioDerived | An attacker who holds (or registers) a low-privileged organization account on a multi-tenant Lotus instance registers a subscription_filter_key crafted to pass the keyword-only validation while carrying SQL syntax, then creates a subscription that uses it; the key is emitted unquoted into the group-by clause of a usage-aggregation query, letting the attacker read other tenants' data from the shared database. A public PoC write-up is referenced (hackmd), but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
RemediationAI
No vendor-released patch or exact fixed version is identified in the supplied data, so treat Lotus 0.10.2 and earlier as vulnerable until an advisory from the project (https://github.com/uselotus/lotus) names a fixed release, and track the VulnCheck advisory for updates. Until then, the most effective compensating control is to restrict creation of subscription_filter_keys to platform administrators rather than ordinary organization users, which removes the low-privilege foothold the attack depends on but slows legitimate tenant self-service onboarding. As a second layer, replace the keyword-only validation with a strict allow-list of permitted group-by columns and render the identifier through psycopg2.sql.Identifier or an equivalent quoting API - the trade-off is that any custom filter keys already in production that fall outside the allow-list will break. Audit existing subscription and subscription_filter_key records for SQL metacharacters or unexpected tokens and disable or delete anything suspicious, and review usage-aggregation logs for anomalous GROUP BY constructs. Where practical, isolate tenants into separate schemas or databases so a successful injection cannot traverse tenant boundaries, at the cost of added operational complexity and cross-tenant reporting effort. Invalidating sessions or credentials of untrusted organization accounts reduces exposure but does not fix the underlying flaw, since any newly registered tenant account restores the attack path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lotus is a Django-based open-source billing and usage-metering application backed by PostgreSQL through psycopg2, and the flaw is a classic CWE-89 injection arising from identifier handling rather than value handling. The affected code path is the model serializer in backend/metering_billing/serializers/model_serializers.py (lines 518-534), where subscription_filter_keys are validated with a keyword-only check - the validation constrains which words are present but does not restrict the character set or grammar of the key. Because SQL bind parameters can only carry values and not identifiers, the key survives validation and is interpolated unquoted into the GROUP BY clause of the usage-aggregation query, so SQL fragments embedded in the key are parsed as query structure at execution time. The multi-tenant architecture amplifies the issue: aggregation queries are issued against a shared database where tenant rows coexist, so an injected predicate or subquery can reach beyond the attacker's own organization. The single-statement execution context of the Django/psycopg2 driver is what constrains secondary integrity and availability impact, which is why the independent assessment rates I:L and A:N even though the reporter's CVSS 4.0 vector claims high integrity and availability impact.
Know when Lotus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Authenticated org user gives PR:L over the network with low complexity and no UI; unquoted group-by injection in a SELECT context yields high cross-tenant read (C:H) but limited integrity and no availability absent stacked-query support.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.
Executive ViewAI
The Lotus billing platform (through version 0.10.2) contains a high-severity SQL injection flaw that allows any authenticated organization-level user to access sensitive billing and usage data belonging to other tenants in the shared database. This represents a significant confidentiality breach risk for multi-tenant deployments, potentially exposing customer financial records and usage patterns. Leadership should prioritize remediation to prevent data leakage and maintain customer trust.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting organization-level user accounts to trusted users, implementing strict input validation for subscription_filter_key to reject non-alphanumeric characters, deploying a web application firewall with virtual patching for SQL injection, and enabling database activity monitoring to detect anomalous cross-tenant queries.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Lotus is an Implementation of the Filecoin protocol written in Go. Rated high severity (CVSS 7.5), this vulnerability is
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant data
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute ar
Improper authentication in the Go event-ingestion middleware of uselotus Lotus through 0.10.2 lets unauthenticated remot
An authorization bypass in Lotus (uselotus/lotus) through 0.10.2 lets a self-registered, authenticated user switch into
Cross-organization insecure direct object reference in Lotus (uselotus/lotus) through 0.10.2 lets an authenticated user
Exploit-DB