Live › vulnerability › CVE-2026-119548
Lago, an open-source billing platform, looks up invoices in its Stripe payment handler without scoping them to the caller's organization. An attacker running their own Stripe integration can send a signed payment success event naming another organization's invoice, marking it paid and unlocking wallet top-ups or subscriptions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Self-hosted or managed Lago deployments through version 1.55.0 that accept Stripe payment events for multiple organizations. The exposure depends on whether tenants can configure their own Stripe integration. Single-tenant installs with only trusted users can likely skip it; the sources do not say more.
No product ranges from the sources yet.
1.55.0).Invoices::Payments::StripeService in your Lago deployment.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
This page as .md · .json · in your agent: get_signal("CVE-2026-119548")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.