CVE-2026-115329 uselotus CVE debrief

Who should care

Defenders managing Lotus installations, especially in multi-organization environments, should assess exposure to this vulnerability. Security teams and administrators responsible for subscription management features in Lotus should prioritize verification and remediation efforts.

Why it matters

CVE-2026-115329 is a medium-severity vulnerability in Lotus that allows cross-organization IDOR via SubscriptionViewSet. Defenders should verify exposure, especially in multi-organization environments, and prioritize remediation by updating to a fixed version or applying patches.

• Potential unauthorized access to sensitive subscription information across organizations.
• Possible modification of subscription plans, addons, or cancellation of services for other organizations.
• Risk of altered billing information for tenants due to IDOR vulnerability.
• Need for verification of current Lotus version and exposure to this vulnerability.

Technical summary

The vulnerability exists in the SubscriptionViewSet.get_object() method of Lotus, which uses an unscoped queryset without organization filtering or permission checks. This allows authenticated users or API keys from any organization to supply another organization's subscription_id and read, cancel, update, switch plans, or modify addons, thereby altering another tenant's billing. The issue affects Lotus installations, particularly in multi-organization environments, where defenders should assess exposure and prioritize verification and remediation efforts.

Defensive priority

Defenders should prioritize verifying exposure of Lotus installations to this IDOR vulnerability, especially in multi-organization environments. Immediate actions include updating to a fixed version if available and restricting access to sensitive subscription management features.

Recommended defensive actions

• Verify if the installed version of Lotus is vulnerable (0.10.2 or earlier).
• Restrict access to subscription management features to prevent unauthorized access.
• Apply the patch or update to a fixed version of Lotus as soon as possible.
• Monitor for suspicious activity related to subscription management.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in Lotus version 0.10.2 and the insecure direct object reference in SubscriptionViewSet.get_object(). Defenders should verify exposure, especially in multi-organization environments, and prioritize remediation by updating to a fixed version or applying patches. Evidence is limited to CVE and source item details; further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.