CVE-2026-115329

Lotus versions through 0.10.2 are vulnerable to an insecure direct object reference (IDOR) within the SubscriptionViewSet.get_object() function. The root cause is the use of an unscoped queryset that lacks necessary organization filtering or permission checks. This allows authenticated users or A...