ENISA's EUVD lists Lago authorization bypass in invoice payment handling (EUVD-2026-113813)
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Lago
- Product
- Lago
- First seen
Summary
The EUVD entry EUVD-2026-113813 reports an authorization bypass in Lago's Invoices::Payments::StripeService through version 1.55.0, scored 2.3/10 (CVSS v3.1). According to the entry, an unscoped invoice lookup lets users of one organization mark another organization's invoice as paid.
If you use Lago
Check whether your Lago deployment runs version 1.55.0 or earlier.
Upgrade to a Lago release that includes the vendor's fix.
Audit recent invoice status changes for unexpected payment markings.
Upgrade Lago to a version later than 1.55.0
Review account and session activity for unexpected invitations or logins
Restrict who holds organization administrator roles
What the sources say 2
· Mastodon: “Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup.” Source
· Mastodon: “Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check.” Source