---
id: CVE-2026-119548
title: >-
  Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe
  Webhook
summary: >-
  Lago through 1.55.0 contains an authorization bypass vulnerability in
  Invoices::Payments::StripeService that allows users of one organization to
  mark another organization's invoice as paid due to an unscoped invoice lookup.
  Attackers con…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: getlago
product: lago
affected:
  - lago <= 1.55.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:02.472992Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:54:44.148Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119548'
references:
  - url: >-
      https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L116-L117
  - url: >-
      https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invoices/payments/stripe_service.rb#L23-L24
  - url: 'https://abraxaslabs.tech/research/lago-stripe-invoice-idor'
  - url: 'https://github.com/getlago/lago-api'
  - url: >-
      https://www.vulncheck.com/advisories/lago-through-1.55.0-cross-organization-invoice-payment-manipulation-via-stripe-webhook
    label: >-
      VulnCheck Advisory: Lago through 1.55.0 Cross-Organization Invoice Payment
      Manipulation via Stripe Webhook
tags:
  - cve.org
epss: 0.00312
epssPercentile: 0.24251
ingestedAt: '2026-11-05T16:07:30.524Z'
---

## Overview

Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organization's Stripe integration can sign a payment_intent.succeeded event carrying a victim invoice UUID to unlock wallet top-ups or payment-gated subscriptions.

## Affected

- `lago <= 1.55.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.