CVE-2026-119420— Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Quick assessment

Affected

getlago lago

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lago 1.55.0 及更早版本存在一个身份验证绕过漏洞，允许组织管理员通过突变操作，在无需密码验证的情况下获取现有账户的会话令牌。攻击者可向受害者邮箱发送邀请，使用任意密码接受该邀请，从而获得用于访问受害者组织、账单数据、API 密钥及支付集成配置的 JWT 令牌。

CVSS 8.8 · High Updated Oct 30, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation

Source: CVE Program / CVE List V5

Vulnerability Description

Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用候选路径或通道进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
getlago	lago	0 ~ 1.55.0	-

II. Public POCs for CVE-2026-119420

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119420

请登录查看更多情报信息。

Other References for CVE-2026-119420 (7)

https://github.com/getlago/lago-api/commit/5a9d5935b027d1db7171c7c015283d5870451305 patch
https://github.com/getlago/lago-api product
https://abraxaslabs.tech/research/lago-invite-ato third-party-advisory
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/users_service.rb#L89-L98 technical-description
https://github.com/getlago/lago-api/blob/v1.55.0/app/services/invites/accept_service.rb#L15-L16 technical-description
https://github.com/getlago/lago-api/pull/6146 issue-tracking patch
https://www.vulncheck.com/advisories/lago-through-1.55.0-authentication-bypass-via-acceptinvite-graphql-mutation third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119420

IV. Related Vulnerabilities

Same product: lago

CVE-2026-119548
Lago through 1.55.0 Cross-Organization Invoice Payment Manip

Same vendor: getlago

CVE-2026-119548
Lago through 1.55.0 Cross-Organization Invoice Payment Manip

Same weakness: CWE-288