Lago
Monthly
Lago's acceptInvite GraphQL mutation (all versions through 1.55.0) issues a valid session JWT for a pre-existing account without verifying that account's password, so an attacker who already holds an organization-administrator role can invite a victim's email address, accept the invite with a password of their choosing, and receive a token that grants access to the victim's organizations, billing data, API keys and payment integrations. Exploitation is authenticated (CVSS 4.0 PR:L) and limited to organizations using the EMAIL_PASSWORD authentication method; SSO-backed organizations are not reachable through this path because the identity provider already validates the email claim, and no victim interaction is required. No public exploit code is confirmed at time of analysis, although a public research writeup describing the attack chain exists, and the vendor has published an upstream fix commit.
Cross-organization invoice payment manipulation in Lago through 1.55.0 allows an authenticated user who controls their own organization's Stripe integration to mark another organization's invoice as paid by signing a payment_intent.succeeded webhook containing the victim invoice UUID. The flaw is an unscoped invoice lookup in Invoices::Payments::StripeService; impact is limited to integrity, with no confidentiality or availability effect, and exploitation requires prior knowledge of a non-enumerable UUID (assessed CVSS 2.3). No working public exploit is confirmed in the supplied sources and no fixed version is listed; the vuln.today decision is monitor.
Lago's acceptInvite GraphQL mutation (all versions through 1.55.0) issues a valid session JWT for a pre-existing account without verifying that account's password, so an attacker who already holds an organization-administrator role can invite a victim's email address, accept the invite with a password of their choosing, and receive a token that grants access to the victim's organizations, billing data, API keys and payment integrations. Exploitation is authenticated (CVSS 4.0 PR:L) and limited to organizations using the EMAIL_PASSWORD authentication method; SSO-backed organizations are not reachable through this path because the identity provider already validates the email claim, and no victim interaction is required. No public exploit code is confirmed at time of analysis, although a public research writeup describing the attack chain exists, and the vendor has published an upstream fix commit.
Cross-organization invoice payment manipulation in Lago through 1.55.0 allows an authenticated user who controls their own organization's Stripe integration to mark another organization's invoice as paid by signing a payment_intent.succeeded webhook containing the victim invoice UUID. The flaw is an unscoped invoice lookup in Invoices::Payments::StripeService; impact is limited to integrity, with no confidentiality or availability effect, and exploitation requires prior knowledge of a non-enumerable UUID (assessed CVSS 2.3). No working public exploit is confirmed in the supplied sources and no fixed version is listed; the vuln.today decision is monitor.