CVE-2026-119548 Details
Description
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
An authorization bypass vulnerability has been identified in Lago versions through 1.55.0, specifically within the Invoices::Payments::StripeService component. This vulnerability allows users from one organization to mark invoices of another organization as paid, exploiting an unscoped invoice lookup. Attackers with control over their organization's Stripe integration can manipulate payment events to unlock wallet top-ups or access payment-gated subscriptions.
The vulnerability can be addressed by updating the invoice lookup process in the Stripe payment handling service to include organization-specific scoping, similar to the existing Adyen payment integration. After applying the patch, the one-time payment event should correctly leave the invoice status as pending, in line with the control scenario.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lago | <= 1.55.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |