---
id: "CVE-2026-119420"
kind: "vulnerability"
aliases: ["CVE-2026-119420"]
title: "Lago: invite flow lets org admins take over existing user accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["billing", "lago", "other", "self-hosted"]
not_affected_if: ["version-above-1.55.0"]
published_at: "2026-10-30T12:16:38+00:00"
first_seen_at: "2026-10-30T12:30:25+00:00"
updated_at: "2026-10-30T12:31:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119420", "first_seen_at": "2026-10-30T12:30:25+00:00"}]
---

# Lago: invite flow lets org admins take over existing user accounts

Lago, an open-source billing platform, lets an organization administrator invite an existing user's email and then accept the invite with an arbitrary password through the acceptInvite mutation, with no password check. The attacker receives a JWT for the victim's account, giving access to the victim's organizations, billing data, API keys and payment integrations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether you run Lago and which version: `unknown` version command in the sources
- Check that the running version is above `1.55.0`, the last version the sources list as affected

## Fix

- Lago through `1.55.0`: the sources do not name a fixed version

## Timeline

- 2026-10-30T12:30:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119420

## From the sources

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_