Description
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization's subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant's billing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
uselotus lotus
Default version status: unaffected
0 to ≤ 0.10.2affected
pkg:github/uselotus/lotusReferences
- https://github.com/uselotus/lotus/issues/799 ↗
- https://github.com/uselotus/lotus/pull/802 ↗
- https://github.com/uselotus/lotus/commit/1375d5140795d72251c89f47200879b9bd1d6d96 ↗
- https://github.com/uselotus/lotus/blob/0.10.2/backend/api/views.py#L754 ↗
- https://github.com/uselotus/lotus ↗
- https://www.vulncheck.com/advisories/lotus-through-0.10.2-cross-organization-idor-via-subscriptionviewset ↗