https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 02:20:33 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-115329 <p>Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization&#39;s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant&#39;s billing.</p> <p>Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization&#39;s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant&#39;s billing.</p> https://db.gcve.eu/vuln/fkie_cve-2026-115329 https://db.gcve.eu/vuln/ghsa-pjmr-f3w6-46qx <p>Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization&#39;s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant&#39;s billing.</p> <p>Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can supply another organization&#39;s subscription_id to read, cancel, update, switch plans, or modify addons, altering another tenant&#39;s billing.</p> https://db.gcve.eu/vuln/ghsa-pjmr-f3w6-46qx