CVE-2026-115330

HIGH 8.8

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

CWE	CWE-89
Vendor	uselotus
Product	lotus
Published	Oct 22, 2026

Stay Ahead of the Next One

Get instant alerts for uselotus lotus

Be the first to know when new high vulnerabilities affecting uselotus lotus are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

uselotus / lotus

0 ≤ 0.10.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@leediay/BkUc3WL2Mx github.com: https://github.com/uselotus/lotus/blob/0.10.2/backend/metering_billing/aggregation/billable_metrics.py#L643-L656 github.com: https://github.com/uselotus/lotus vulncheck.com: https://www.vulncheck.com/advisories/lotus-through-0.10.2-sql-injection-via-custom-sql-billable-metrics

Credits

leediay153 from Viettel Post