Lotus
Monthly
An authorization bypass in Lotus (uselotus/lotus) through 0.10.2 lets a self-registered, authenticated user switch into a different tenant by POSTing that organization's UUID to /app/switch_organization/, after which the victim tenant's data and billing configuration become reachable. Access is not unrestricted: the attacker must obtain the target organization's random, non-guessable UUID out of band, which is the main practical barrier and the reason the vector carries AC:H/AT:P despite the low-privilege (PR:L) requirement. Exploitation status is not confirmed in the available sources - no CISA KEV entry and no verified working exploit code were provided, though a public technical writeup reference is linked; priority is 'this_week', i.e. a genuine but not drop-everything issue, and no fixed version is listed in the available data.
Improper authentication in the Go event-ingestion middleware of uselotus Lotus through 0.10.2 lets unauthenticated remote attackers submit usage events to POST /api/track/ on behalf of another organization, corrupting that tenant's metered usage and billing records. The flaw is integrity-only (no data disclosure or availability impact) and exploitation hinges on knowing or obtaining a valid API key prefix, since the secret half of the key is never compared against the stored hashed_key; the sources do not explain how a prefix would be leaked or enumerated. No public exploit code was identified at time of analysis and the vulnerability is not in CISA KEV, though VulnCheck reporting and a public technical writeup give the issue a this_week remediation priority; the blast radius is narrow but the defect is a genuine authentication bypass.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
Cross-organization insecure direct object reference in Lotus (uselotus/lotus) through 0.10.2 lets an authenticated user or a valid API key from any organization read, cancel, update, switch plans on, or modify add-ons of another tenant's subscription - and therefore alter that tenant's billing - by supplying the victim's subscription_record_id to SubscriptionViewSet. The handler resolves the object from the unscoped queryset rather than the organization-filtered one, so tenant isolation is not enforced; no special configuration is needed because this is the default code path on multi-organization deployments. An upstream fix exists in pull request #802 / commit 1375d5140795d72251c89f47200879b9bd1d6d96, but no released patched version is independently confirmed, and no public exploit code was identified at time of analysis; the practical constraint is that the target subscription_record_id is a UUID and must be known or enumerated.
Lotus is an Implementation of the Filecoin protocol written in Go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An authorization bypass in Lotus (uselotus/lotus) through 0.10.2 lets a self-registered, authenticated user switch into a different tenant by POSTing that organization's UUID to /app/switch_organization/, after which the victim tenant's data and billing configuration become reachable. Access is not unrestricted: the attacker must obtain the target organization's random, non-guessable UUID out of band, which is the main practical barrier and the reason the vector carries AC:H/AT:P despite the low-privilege (PR:L) requirement. Exploitation status is not confirmed in the available sources - no CISA KEV entry and no verified working exploit code were provided, though a public technical writeup reference is linked; priority is 'this_week', i.e. a genuine but not drop-everything issue, and no fixed version is listed in the available data.
Improper authentication in the Go event-ingestion middleware of uselotus Lotus through 0.10.2 lets unauthenticated remote attackers submit usage events to POST /api/track/ on behalf of another organization, corrupting that tenant's metered usage and billing records. The flaw is integrity-only (no data disclosure or availability impact) and exploitation hinges on knowing or obtaining a valid API key prefix, since the secret half of the key is never compared against the stored hashed_key; the sources do not explain how a prefix would be leaked or enumerated. No public exploit code was identified at time of analysis and the vulnerability is not in CISA KEV, though VulnCheck reporting and a public technical writeup give the issue a this_week remediation priority; the blast radius is narrow but the defect is a genuine authentication bypass.
SQL injection in the Lotus (uselotus/lotus) metering and billing platform through 0.10.2 lets an authenticated organization-level user smuggle SQL into usage-aggregation queries by registering a crafted subscription_filter_key that passes the keyword-only validator and is later rendered as an unquoted GROUP BY identifier. Per the assessed vector (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), the dominant impact is high-confidentiality disclosure of billing and usage data held in the shared multi-tenant database, with limited integrity impact and no availability effect; the reporter's CVSS 4.0 vector scores it 8.7. No CISA KEV entry or confirmed working exploit code was identified at time of analysis, though a public technical writeup is referenced, and vuln.today sequencing places this in the this-week remediation queue - the practical prerequisite is a valid tenant account on a deployment where aggregation queries span tenants.
SQL injection in Lotus through 0.10.2 lets authenticated organization users read and modify the shared multi-tenant database by embedding crafted SQL in billable metric property_name or categorical filter values, which are rendered unescaped into Jinja-generated counter, gauge and rate queries. Exploitation requires a valid account with metric-configuration access (PR:L) but no victim interaction; the CVSS 4.0 score is 8.7. No CISA KEV entry is present, and no working exploit code is confirmed in the supplied sources.
SQL injection in the Lotus billing platform through 0.10.2 allows an authenticated organization-level user to execute arbitrary stacked SQL statements through POST /app/metrics/, enabling cross-tenant reads and modifications of data in the shared database. The weakness bypasses first-statement-only validation because semicolon-appended statements are executed unfiltered. Exploitation requires a legitimate tenant account and access to the custom billable-metric query feature; no public exploit has been identified at time of analysis.
Cross-organization insecure direct object reference in Lotus (uselotus/lotus) through 0.10.2 lets an authenticated user or a valid API key from any organization read, cancel, update, switch plans on, or modify add-ons of another tenant's subscription - and therefore alter that tenant's billing - by supplying the victim's subscription_record_id to SubscriptionViewSet. The handler resolves the object from the unscoped queryset rather than the organization-filtered one, so tenant isolation is not enforced; no special configuration is needed because this is the default code path on multi-organization deployments. An upstream fix exists in pull request #802 / commit 1375d5140795d72251c89f47200879b9bd1d6d96, but no released patched version is independently confirmed, and no public exploit code was identified at time of analysis; the practical constraint is that the target subscription_record_id is a UUID and must be known or enumerated.
Lotus is an Implementation of the Filecoin protocol written in Go. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.