Read the docs
TI-2026-82999 Aliases CVE-2026-119420GHSA-gvqv-g6vj-p22g

Lago Authentication Bypass via acceptInvite GraphQL Mutation

Priority HIGH 73CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Lago versions through 1.55.0 skip the password check in the acceptInvite GraphQL mutation, a flaw classified as CWE-288 (authentication bypass using an alternate path). An authenticated organization administrator with low privileges can obtain a session token for an existing account without its password, exposing that account's organizations, billing data, API keys and payment integrations. No user interaction is required and the attack is possible over the network.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getlagolagoup to 1.55.0—No fix listedCNA
  • lago Vendorgetlago Affected up to 1.55.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Lago.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-119420
  2. 2026-10-30 Alias added: GHSA-gvqv-g6vj-p22g
  3. 2026-11-01 Priority changed: MEDIUM → LOW
  4. 2026-11-05 CISA SSVC decision points changed
  5. 2026-11-05 Priority changed: LOW → HIGH

References

Patch 2

Advisory 1

Other 3

  • TI-2026-83012 Lago lets users mark other organizations' invoices as paid CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences