An insecure direct object reference in Lotus's SubscriptionViewSet allows an authenticated user to supply a subscription identifier belonging to another organization. The vulnerability permits reading, canceling, updating, switching plans, or modifying add‑ons for that subscription, thereby exposing and altering another tenant's billing data. This can result in revenue loss, incorrect invoicing, and potential legal consequences from unauthorized financial changes.

Lotus versions up to 0.10.2 from the uselotus vendor are impacted. The flaw resides in the backend API that lacks organization‑level filtering or permission checks.

The CVSS score of 6 rates the vulnerability as medium severity. No EPSS score is publicly available, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to have authenticated access to the Lotus API, after which they can supply any organization’s subscription ID. The lack of additional exploitation prerequisites means that once API credentials are obtained, the vulnerability can be leveraged to manipulate another tenant’s billing configuration.