THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-3504

Improper Access Control in lunary-ai/lunary

Assigner:@huntr_ai (c09c270a-b464-47c1-9133-acb35b22c19a)
Reserved:2024-04-09
Published:2024-06-06
Updated:2024-06-06

Description

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.



HIGH: 8.1CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

CWE-284 Improper Access Control

Product status

Any version before 1.2.7
affected

References

https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28

https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f

cve.org CVE-2024-3504

nvd.nist.gov CVE-2024-3504

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-3504