Search
Find a vulnerability
Search criteria
4 vulnerabilities found for lago by getlago
CVE-2026-119548 (GCVE-0-2026-119548)
Vulnerability from nvd – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
Summary
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://abraxaslabs.tech/research/lago-stripe-inv… | third-party-advisory |
| https://github.com/getlago/lago-api | product |
| https://www.vulncheck.com/advisories/lago-through… | third-party-advisory |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:02.472992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:44.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lago",
"repo": "https://github.com/getlago/lago-api",
"vendor": "getlago",
"versions": [
{
"lessThanOrEqual": "1.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization\u0027s invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization\u0027s Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:00.682Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/lago-stripe-invoice-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/getlago/lago-api"
},
{
"name": "VulnCheck Advisory: Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook"
}
],
"title": "Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119548",
"datePublished": "2026-10-30T11:31:00.682Z",
"dateReserved": "2026-10-30T10:53:25.150Z",
"dateUpdated": "2026-10-30T15:54:44.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119420 (GCVE-0-2026-119420)
Vulnerability from nvd – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
Summary
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
Severity
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/getlago/lago-api/commit/5a9d59… | patch |
| https://github.com/getlago/lago-api/pull/6146 | issue-trackingpatch |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://abraxaslabs.tech/research/lago-invite-ato | third-party-advisory |
| https://github.com/getlago/lago-api | product |
| https://www.vulncheck.com/advisories/lago-through… | third-party-advisory |
Date Public
2026-08-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lago",
"repo": "https://github.com/getlago/lago-api",
"vendor": "getlago",
"versions": [
{
"lessThanOrEqual": "1.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim\u0027s email, accept with an arbitrary password, and receive a JWT to access the victim\u0027s organizations, billing data, API keys and payment integrations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:51.565Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/getlago/lago-api/pull/6146"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/lago-invite-ato"
},
{
"tags": [
"product"
],
"url": "https://github.com/getlago/lago-api"
},
{
"name": "VulnCheck Advisory: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation"
}
],
"title": "Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119420",
"datePublished": "2026-10-30T11:30:51.565Z",
"dateReserved": "2026-10-30T02:41:12.203Z",
"dateUpdated": "2026-10-30T11:30:51.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119548 (GCVE-0-2026-119548)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 15:54
VLAI
EPSS
VEX
Title
Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
Summary
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:21 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://abraxaslabs.tech/research/lago-stripe-inv… | third-party-advisory |
| https://github.com/getlago/lago-api | product |
| https://www.vulncheck.com/advisories/lago-through… | third-party-advisory |
Date Public
2026-09-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119548",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:21:02.472992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:54:44.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lago",
"repo": "https://github.com/getlago/lago-api",
"vendor": "getlago",
"versions": [
{
"lessThanOrEqual": "1.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-09-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization\u0027s invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization\u0027s Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:00.682Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/lago-stripe-invoice-idor"
},
{
"tags": [
"product"
],
"url": "https://github.com/getlago/lago-api"
},
{
"name": "VulnCheck Advisory: Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook"
}
],
"title": "Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119548",
"datePublished": "2026-10-30T11:31:00.682Z",
"dateReserved": "2026-10-30T10:53:25.150Z",
"dateUpdated": "2026-10-30T15:54:44.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119420 (GCVE-0-2026-119420)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:30 – Updated: 2026-10-30 11:30
VLAI
EPSS
VEX
Title
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
Summary
Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.
Severity
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/getlago/lago-api/commit/5a9d59… | patch |
| https://github.com/getlago/lago-api/pull/6146 | issue-trackingpatch |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://github.com/getlago/lago-api/blob/v1.55.0/… | technical-description |
| https://abraxaslabs.tech/research/lago-invite-ato | third-party-advisory |
| https://github.com/getlago/lago-api | product |
| https://www.vulncheck.com/advisories/lago-through… | third-party-advisory |
Date Public
2026-08-13 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "lago",
"repo": "https://github.com/getlago/lago-api",
"vendor": "getlago",
"versions": [
{
"lessThanOrEqual": "1.55.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-08-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim\u0027s email, accept with an arbitrary password, and receive a JWT to access the victim\u0027s organizations, billing data, API keys and payment integrations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:30:51.565Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/getlago/lago-api/pull/6146"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/lago-invite-ato"
},
{
"tags": [
"product"
],
"url": "https://github.com/getlago/lago-api"
},
{
"name": "VulnCheck Advisory: Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation"
}
],
"title": "Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119420",
"datePublished": "2026-10-30T11:30:51.565Z",
"dateReserved": "2026-10-30T02:41:12.203Z",
"dateUpdated": "2026-10-30T11:30:51.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}