Vulnerability · Published Oct 22, 2026 · Assigned by VulnCheck

CVE-2026-115334Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Medium 6.8

In plain English

A medium-severity authorization bypass via user-controlled key in lotus from uselotus. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

Affected products (as reported)

Vendor	Product	Versions
uselotus	lotus	0 – through 0.10.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://hackmd.io/@leediay/BkUc3WL2Mx technical-description
https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/views/views.py#L326-L340 technical-description
https://github.com/uselotus/lotus product
VulnCheck Advisory: Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint third-party-advisory