4 matches found
CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...
CVE-2026-115329
Lotus versions through 0.10.2 are vulnerable to an insecure direct object reference (IDOR) within the SubscriptionViewSet.get_object() function. The root cause is the use of an unscoped queryset that lacks necessary organization filtering or permission checks. This allows authenticated users or A...
CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...
CVE-2026-115329 Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...