Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-119420

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getlago
Products
Lago
CVE-2026-119548

Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Getlago
Products
Lago