Lotus versions up to 0.10.2 permit authenticated organization users to inject SQL by supplying specially crafted subscription_filter_keys. The application allows these keys to be registered without proper quoting, causing them to be rendered as an unquoted group‑by identifier in usage aggregation queries against a shared multi‑tenant database. This flaw allows malicious users to inject and execute arbitrary SQL statements, potentially exposing, modifying, or deleting sensitive data, and disrupting service availability.

The affected product is Lotus by uselotus, specifically version 0.10.2. Earlier releases prior to 0.10.2 are not explicitly listed as affected but are assumed not to contain the flaw.

The CVSS base score of 8.7 indicates high severity, and while EPSS data is absent, the vulnerability is not listed in the KEV catalog. The attack requires an authenticated organization user with permissions to create subscriptions; upon submitting a malicious key, the key is later used in a database query, allowing the insertion of arbitrary SQL. Consequently, the risk is high due to the potential for data breach or alteration and the need for privileged access.