Live › vulnerability › CVE-2026-115334
Go to dashboardLotus through 0.10.2 has an authorization flaw in ChangeUserOrganizationView.post that lets any logged-in user join an organization by supplying its UUID. An attacker who knows another tenant's UUID can reach that tenant's data and billing configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Lotus up to and including 0.10.2 where users can self-register and where multiple organizations (tenants) share one instance. A single-tenant install with self-registration closed to outsiders is much less exposed. Teams running only a single organization can likely skip it.
No product ranges from the sources yet.
unknown if the sources do not say how it is installed or where the version is recorded./app/switch_organization/ endpoint in the deployed application and confirm whether self-registration is enabled.0.10.2: the fixed version is unknown from the sources./app/switch_organization/ to trusted users.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.
This page as .md · .json · in your agent: get_signal("CVE-2026-115334")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.