Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119548Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Low 3.1

In plain English

A low-severity authorization bypass via user-controlled key in lago from getlago. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 75.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

Affected products (as reported)

Vendor	Product	Versions
getlago	lago	0 – through 1.55.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117 technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24 technical-description
https://abraxaslabs.tech/research/lago-stripe-invoice-idor third-party-advisory
https://github.com/getlago/lago-api product
VulnCheck Advisory: Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook third-party-advisory