Lago EUVD-2026-113800

The attacker must already hold an authenticated organization-administrator role on the Lago instance (PR:L) and use the EMAIL_PASSWORD login method - the fix shows SSO flows were unaffected because the identity provider already validates the email. The admin must be able to issue an invite to the victim's email and the victim must already exist as a Lago user; pre-patch, invites.accept_service registered/accepted the invite and returned a JWT via the email/password path without calling any password check for that existing account. No victim user interaction is required. Limiting factors: requires valid admin credentials on the target instance, requires email/password auth (SSO-only organizations are not exploitable via this path), and affects only Lago versions 0 through 1.55.0.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is driven by full account takeover impact, but the single most important mitigating signal is PR:L: exploitation requires the attacker to already be an authenticated organization administrator, so this is an insider or compromised-admin privilege-escalation/lateral-movement issue rather than a remote-unauthenticated mass-exploitation bug. No EPSS probability is provided and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_week' (priority but not emergency/act_now), which is consistent with high impact tempered by the privilege precondition. A public technical writeup (abraxaslabs 'lago-invite-ato') and a VulnCheck advisory document the technique, and the fixing commit confirms the mechanism, so the flaw is well-understood and reproducible even though no confirmed weaponized exploit code is cited. Net: a genuine high-severity authentication-bypass worth patching promptly for anyone running self-hosted Lago with multiple tenants/admins, but not an internet-wide drive-by emergency given the PR:L requirement and absence of KEV/EPSS signals.

An authenticated organization administrator on a Lago instance invites a victim's email address into an organization they control, then calls the acceptInvite GraphQL mutation supplying an arbitrary password; pre-patch, the email/password accept path issued a JWT for the pre-existing victim account without ever verifying the victim's real password. The admin thereby obtains a valid session for the victim and reaches the victim's other organizations, billing data, API keys and payment integrations. A public research PoC reference exists (abraxaslabs) describing this invite-to-account-takeover flow, though it is not verified as working exploit code in the provided data.