Lotus versions up to 0.10.2 contain an authorization bypass in the ChangeUserOrganizationView.post endpoint. An authenticated user can specify any organization UUID in a POST request to /app/switch_organization/, and the application will join that organization and expose its data and billing configuration. The flaw does not allow arbitrary code execution but permits users to impersonate any tenant that they know the UUID of,

The affected product is Lotus by uselotus, specifically all releases up through 0.10.2. Versions newer than 0.10.2 are not known to be vulnerable,

The CVSS score of 7.6 indicates a high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must already be authenticated and must discover or guess a target organization’s UUID to exploit the flaw. While the exploitation path is straightforward, the requirement for valid credentials and knowledge of the UUID limits the attack surface, yet the impact on an organization’s sensitive data makes the vulnerability significant.