Is CVE-2026-115329 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-115329?

CVE-2026-115329 has a CVSS v3 severity of MEDIUM (5.9).

Back

CVE-2026-115329

Description

Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.