Lotus 0.10.2 SQL Injection Allows Authenticated Users to Target Shared Database
A high-severity flaw in Lotus lets authenticated users inject SQL via subscription filters, risking data exposure in multi-tenant environments.
Key points
- CVE-2026-115332 is rated 8.7 HIGH on the CVSS scale.
- The flaw affects Lotus versions up to and including 0.10.2.
- Attackers need valid organization credentials to exploit the vulnerability.
Lotus through version 0.10.2 contains a high-severity SQL injection vulnerability that exposes multi-tenant databases to authenticated attackers. According to the NVD record, this flaw allows users within an organization to manipulate subscription filter keys, bypassing validation controls intended to restrict input to keywords only.
Root cause
The vulnerability stems from inadequate input validation in the subscription registration process. When users register crafted subscription_filter_keys, the application fails to sanitize these inputs properly. Instead of treating the values as simple text, the system renders the malicious key as an unquoted group-by identifier. This behavior allows SQL code to be injected directly into usage aggregation queries.
Attack path
An attacker must first possess valid credentials for an organization account in Lotus. Once authenticated, the user creates a subscription using a specially crafted filter key. This key is designed to bypass the application’s keyword-only validation checks. The malicious input is then processed by the backend database, injecting arbitrary SQL commands into queries that aggregate usage data across the shared multi-tenant environment.
Affected versions
- Lotus version 0.10.2
- All earlier versions of Lotus
Mitigation
- No fix has been confirmed yet.
- Isolate affected Lotus instances from critical network segments if possible.
- Monitor database activity for unusual query patterns or unauthorized access attempts.
- Review logs for any subscription registrations containing unexpected characters or structures.
Detection notes
Security teams should monitor database logs for anomalous SQL syntax or unexpected group-by clauses in aggregation queries. Alert on subscription creation events that involve complex or unusual filter keys. Check for deviations in query execution times or resource usage spikes that may indicate injection attempts. Verify that all input validation rules are strictly enforced at the application layer. Look for any unauthorized data access patterns that do not align with normal user behavior.
Background: SQL injection
SQL injection occurs when untrusted input alters database commands. You remain vulnerable when you concatenate strings, ignore parameterized queries, or trust hidden form fields. Fix these errors by using prepared statements, validating input types, and applying least privilege to database accounts. These steps block most injection attempts.
Read the full guide: SQL Injection Mistakes That Leave Your Database Exposed
What to do and how to stay safe: Lotus
- Audit current Lotus installations to confirm they are not running vulnerable versions.
- Implement strict input validation for all user-supplied data in subscription filters.
- Monitor database logs for signs of SQL injection attempts or unusual query structures.
- Prepare an incident response plan in case exploitation is detected.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the severity of CVE-2026-115332?
It is rated 8.7 HIGH on the CVSS scale.
Do attackers need special privileges to exploit this flaw?
Yes, they must be authenticated users within an organization.
Which versions of Lotus are affected?
All versions up to and including 0.10.2 are affected.
