https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-01T00:29:07.830799+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-119548 fkie_cve-2026-119548 2026-11-01T00:29:07.847999+00:00

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

 https://db.gcve.eu/vuln/ghsa-8w2c-cm2g-cxq6 GHSA-8w2c-cm2g-cxq6 2026-11-01T00:29:07.848074+00:00

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.