Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: getlago Clear all filters
TI-2026-83012 CVE-2026-119548 · GHSA-8w2c-cm2g-cxq6

Lago lets users mark other organizations' invoices as paid

Priority LOW 12

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice look…

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00312 Published 2026-10-30 No fix listed CWE-639
TI-2026-82999 CVE-2026-119420 · GHSA-gvqv-g6vj-p22g

Lago Authentication Bypass via acceptInvite GraphQL Mutation

Priority HIGH 73

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00394 Published 2026-10-30 No fix listed CWE-288