CVE-2026-115334

Deferred Deferred - Pending Action

Lotus Authorization Bypass via Organization UUID

Publication date: 2026-10-22

Last updated on: 2026-10-22

Assigner: VulnCheck

Description

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-22

Generated

2026-10-23

AI Q&A

2026-10-23

EPSS Evaluated

N/A

NVD

CVE-2026-115334

Affected Vendors & Products

Vendor	Product	Version / Range
uselotus	lotus	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Lotus through version 0.10.2 has an authorization bypass flaw in the ChangeUserOrganizationView.post function. Authenticated users can join any organization by providing its UUID, allowing attackers who self-register and know another organization's UUID to access that tenant's data and billing settings via a POST request to /app/switch_organization/.

Detection Guidance

Check Lotus application logs for POST requests to /app/switch_organization/ from unauthorized users. Monitor for unusual organization switches or access to tenant data by users not belonging to that organization.

Impact Analysis

An attacker could gain unauthorized access to sensitive data and billing information of any organization they know the UUID for, potentially leading to data breaches, financial loss, or misuse of resources.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information, potentially resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Update Lotus to the latest version beyond 0.10.2. Implement strict access controls to prevent unauthorized POST requests to /app/switch_organization/. Review and restrict user permissions to join organizations.

Hi! I’m here to help you understand CVE-2026-115334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70