Low severity · published Oct 30, 2026
CVE-2026-119548
Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
New
3.1
CVSS
–
EPSS
No
On KEV
Description
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
lago · getlago
through 1.55.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-119548
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-119548
technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117
technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24
third-party-advisory
https://abraxaslabs.tech/research/lago-stripe-invoice-idor
product
https://github.com/getlago/lago-api
third-party-advisory
https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook
More from lago
8.8
CVE-2026-119420
Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation