These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-115334 is an authorization bypass vulnerability in Lotus through version 0.10.2. An authenticated user can join any organization by supplying its UUID via the switch_organization endpoint, potentially allowing access to that tenant's data and billing configuration. This vulnerability exists in the ChangeUserOrganizationView.post method and allows authenticated users to join any organization, pote [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-22T10:57:49.499Z and has not been modified since then. Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that validates API keys by prefix only, without checking the secret against the stored hashed_key. This vulnerability allows attackers wh [truncated]
A SQL injection vulnerability exists in Lotus through version 0.10.2, allowing authenticated organization users to inject malicious SQL by registering crafted subscription_filter_keys. This can lead to SQL injection in usage aggregation queries against the shared multi-tenant database. The vulnerability requires attention from defenders responsible for systems using this version, as it can lead to potenti [truncated]
A CVE debrief for CVE-2026-115331 based on the supplied source corpus. The vulnerability is a SQL injection issue in Lotus through 0.10.2, allowing authenticated organization users to inject SQL by supplying crafted billable metric property_name or categorical filter values. This could lead to unauthorized access to the database shared by all tenants. Defenders should assess exposure and potential impact, [truncated]
A SQL injection vulnerability exists in Lotus through version 0.10.2, allowing authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries via POST /app/metrics/. This could enable attackers to read or modify data across all tenants. The vulnerability is particularly concerning as it allows attackers to bypass first-statement-only validation, potentia [truncated]
CVE-2026-115329 is a vulnerability in Lotus through version 0.10.2, where an insecure direct object reference (IDOR) exists in SubscriptionViewSet.get_object(). This allows authenticated users or API keys from any organization to access, modify, or cancel subscriptions of another organization by supplying a different organization's subscription_id.