Vulnerability record/PUBLISHED/Published Oct 30, 2026 11:31:00 UTC
CVE-2026-119548
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Base score2.3/ 10
SeverityLowCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityLow
Attack vectorNetworkAV
Attack complexityHighAC
Attack requirementsPresentAT
Privileges requiredLowPR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityLowVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedOct 30, 2026 15:54:44 UTC
PublishedOct 30, 2026 11:31:00 UTC
ReservedOct 30, 2026 10:53:25 UTC
Credits
- Abraxas Labs