CVE-2026-115329

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...

CVE-2026-115329

Lotus versions through 0.10.2 are vulnerable to an insecure direct object reference (IDOR) within the SubscriptionViewSet.get_object() function. The root cause is the use of an unscoped queryset that lacks necessary organization filtering or permission checks. This allows authenticated users or A...

EUVD-2026-108131

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.getobject that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription...