{"id":"CVE-2026-119548","kind":"vulnerability","aliases":["CVE-2026-119548"],"related":[],"title":"Lago: billing flaw lets one organization mark another's invoice paid","description":"Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.","summary":"Lago, an open-source billing platform, looks up invoices in its Stripe payment handler without scoping them to the caller's organization. An attacker running their own Stripe integration can send a signed payment success event naming another organization's invoice, marking it paid and unlocking wallet top-ups or subscriptions.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["billing","lago","other","self-hosted","stripe"],"not_affected_if":["no-stripe-integration","single-organization"],"how_to_check":"- Check the installed Lago version against the affected range (through `1.55.0`).\n- Look for the Stripe payment handling in `Invoices::Payments::StripeService` in your Lago deployment.","fix":null,"status":"open","published_at":"2026-10-30T12:16:41+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","triaged_at":"2026-10-30T12:34:12+00:00","updated_at":"2026-10-30T12:34:12+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T12:34:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Lago: billing flaw lets one organization mark another's invoice paid","impact":"medium","summary":"Lago, an open-source billing platform, looks up invoices in its Stripe payment handler without scoping them to the caller's organization. An attacker running their own Stripe integration can send a signed payment success event naming another organization's invoice, marking it paid and unlocking wallet top-ups or subscriptions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["lago","billing","stripe","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker marks another organization's invoices paid, unlocking paid services","analyst_note":"Confirm the fixed version and whether a patch exists; the sources give no fix version. Check the NVD entry for the Lago project advisory.","how_to_check":"- Check the installed Lago version against the affected range (through `1.55.0`).\n- Look for the Stripe payment handling in `Invoices::Payments::StripeService` in your Lago deployment.","plain_action":"","needs_analyst":true,"not_affected_if":["single-organization","no-stripe-integration"],"who_is_affected":"Self-hosted or managed Lago deployments through version 1.55.0 that accept Stripe payment events for multiple organizations. The exposure depends on whether tenants can configure their own Stripe integration. Single-tenant installs with only trusted users can likely skip it; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.0007,"input_tokens":4171,"output_tokens":566,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119548':14A,17A '-2026':13A,16A '1.55.0':80C 'allow':91C 'anoth':8A,63B,98C 'attack':49B,110C 'author':83C 'bill':2A,18B,30B 'bypass':84C 'caller':45B 'carri':122C 'contain':81C 'control':111C 'cve':12A,15A 'due':104C 'event':61B,121C 'flaw':3A 'gate':136C 'handler':39B 'host':23B 'integr':54B,116C 'invoic':10A,34B,66B,87C,101C,108C,125C 'lago':1A,19B,25B,78C 'let':4A 'look':32B 'lookup':109C 'mark':7A,67B,97C 'name':62B 'one':5A,94C 'open':28B 'open-sourc':27B 'organ':6A,47B,64B,95C,99C,113C 'paid':11A,69B,103C 'payment':38B,59B,88C,135C 'payment-g':134C 'payment_intent.succeeded':120C 'platform':31B 'run':50B 'scope':41B 'self':22B 'self-host':21B 'send':56B 'sign':58B,118C 'sourc':29B 'stripe':24B,37B,53B,115C 'stripeservic':89C 'subscript':77B,137C 'success':60B 'top':74B,131C 'top-up':73B,130C 'unlock':71B,128C 'unscop':107C 'up':75B,132C 'user':92C 'uuid':126C 'victim':124C 'vulner':85C 'wallet':72B,129C 'without':40B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or managed Lago deployments through version 1.55.0 that accept Stripe payment events for multiple organizations. The exposure depends on whether tenants can configure their own Stripe integration. Single-tenant installs with only trusted users can likely skip it; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119548","severity":null,"published_at":"2026-10-30T12:16:41+00:00","modified_at":"2026-10-30T12:16:41+00:00","first_seen_at":"2026-10-30T12:30:26+00:00","fetched_at":"2026-10-30T12:30:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}