Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• abraxaslabs.tech/research/lago-stripe-invoice-idor Üçüncü taraf
• vulncheck.com/…nvoice-payment-manipulation-via-stripe-webhook Üçüncü taraf
• github.com/…p/services/invoices/payments/stripe_service.rb Diğer
• github.com/…p/services/invoices/payments/stripe_service.rb Diğer
• github.com/getlago/lago-api Diğer

Kayıt geçmişi

1. 30 Eki 2026 14:31Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-119420Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation
• 4,3 CVE-2026-119555Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
• 4,3 CVE-2026-119547Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
• 5,9 CVE-2026-119421Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
• 4,3 CVE-2026-118947Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor
• 8,1 CVE-2026-61671WeGIA: Kayıt sahipliği denetimi eksik IDOR ve CSRF koruması eksik (3.8.7 öncesi)