Lotus through version 0.10.2 contains an SQL injection vulnerability that allows authenticated organization users to inject arbitrary SQL statements by supplying crafted values for the billable metric property_name or categorical filter fields. The application renders these values directly into Jinja-generated counter, gauge, and rate metric queries without escaping, giving attackers unrestricted read and modification access to the shared database that all tenants use.

The affected product is Lotus, a multi-tenant monitoring and billing platform provided by uselotus. Versions 0.10.2 and all earlier releases are impacted. The vulnerability is triggered when an authenticated user submits a metric definition containing a malicious property_name or filter value. No specific system operating system or architecture is listed, so the impact applies to any environment running the affected Lotus version.

The CVSS score of 8.7 places the flaw in the High impact category, while the EPSS score is unavailable, indicating that the exploitation likelihood is currently unknown. The vulnerability is not listed in the CISA KEV, suggesting that no publicized active exploitation has been documented yet. Attackers require authenticated organization-level access, meaning the threat surface is controlled to users with privileged roles within a tenant. Nevertheless, the ability to read and modify the shared database can lead to data leakage, integrity loss, and potential denial-of-service. Without a public exploit, the immediate risk is moderate to high dependent on the distribution of authenticated users.