CVE-2026-115330
Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 22, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 22, 2026
Description
Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
lotususelotus |
|
References
- https://hackmd.io/@leediay/BkUc3WL2Mxtechnical-description
- https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656technical-description
- https://github.com/uselotus/lotusproduct
- VulnCheck Advisory: Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metricsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.