lago-stripe-invoice-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-stripe-invoice-idor Write-up: https://abraxaslabs.tech/research/lago-stripe-invoice-idor lago-stripe-invoice-idor Lago v1.53.0 - GetLago POST /webhooks/stripe/:organizationid verifies Stripe-Signature with that...

lago-invite-ato

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · lago-invite-ato Write-up: https://abraxaslabs.tech/research/lago-invite-ato lago-invite-ato Lago v1.53.0 - GetLago Mutations::Invites::Accept has no AuthenticableApiUser. Create/revoke do. Accept does not...

CVE-2026-119548

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119420

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

EUVD-2026-113813

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119548 Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119548 Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119548 Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119548

Lago versions up to and including 1.55.0 are vulnerable to an authorization bypass in the Invoices::Payments::StripeService component. The root cause is an unscoped invoice lookup , which allows an attacker controlling their own organization's Stripe integration to sign a payment_intent.succeeded...

CVE-2026-119420

The software Lago (versions through 1.55.0) is vulnerable to an authentication bypass via the acceptInvite GraphQL mutation. This vulnerability allows organization administrators to obtain session tokens for existing accounts without a password check. By inviting a victim's email and accepting th...

CVE-2026-119420 Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

EUVD-2026-113800

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

CVE-2026-119420 Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

PT-2026-133473

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

CVE-2026-119548: getlago lago: Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows…

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

CVE-2026-119420: getlago lago: Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain…

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive ...

PT-2026-133486

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a...

lago-reisen.de Cross Site Scripting vulnerability OBB-3740527

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

lago-car.pl Cross Site Scripting vulnerability OBB-3723030

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

lago-car.pl Cross Site Scripting vulnerability OBB-2976036

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...