Lotus authorization issue vulnerability

Lotus versions 0.10.2 and earlier contain an authorization issue vulnerability. This vulnerability stems from an authorization bypass in ChangeUserOrganizationView.post, allowing authenticated users to join any organization by providing a UUID. Once attackers obtain other organizations’ UUIDs, th...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the rate editing process for projects, customers, and activities. An attacker can modify billing-related rate configurations outside their authorized scope by combining an authorized...