CVE-2026-115329

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...