The vulnerability in Lago version 1.55.0 allows a user of one organization to mark a different organization’s invoice as paid because the invoice lookup is not scoped to the requesting organization. An attacker who controls their own organization‘s Stripe integration can sign a payment_intent.succeeded event containing the victim invoice’s UUID, which triggers wallet top‑ups or activates payment‑gated subscriptions for the victim. This flaw constitutes an authorization bypass (CWE‑639) that can lead to financial loss and unintended service usage.

The affected product is Lago from getlago, specifically all releases up to and including 1.55.0. Users of any 1.55.0 or earlier edition are vulnerable.

The published CVSS score of 2.3 indicates a low severity rating, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires that the attacker controls the Stripe integration for their own organization to sign a valid webhook payload. Thus, the exploitability is limited to individuals with access to the secret signing key and the ability to craft a payment_intent.succeeded event. Remote or unauthenticated exploitation is therefore improbable. Nonetheless, the ability to misrepresent invoice ownership can lead to unauthorized payments or service activation for the victim organization.