CVE-2026-119548 Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119548?
CVE-2026-119548 is a low-severity vulnerability in getlago lago, published on 30 Oct 2026.
Official description
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.
Weakness: CWE-639
Which versions are affected by CVE-2026-119548?
How do I fix CVE-2026-119548?
No fix has been published for CVE-2026-119548 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119548 being exploited?
There is no known exploitation of CVE-2026-119548 in the wild and no public exploit code.
Sources
Also known as GHSA-8w2c-cm2g-cxq6.