Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 2.3 · getlagoNVD modified 2026-10-30 11:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117 technical-description
- https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24 technical-description
- https://abraxaslabs.tech/research/lago-stripe-invoice-idor third-party-advisory
- https://github.com/getlago/lago-api product
- https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook third-party-advisory