PT-2024-26295 · Lunary Ai · Lunary

Published 2024-06-06 · Updated 2025-10-15 · CVE-2024-3504

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.2

Description An improper access control issue exists, allowing an admin to update any organization user to the organization owner. This enables the elevated user to delete projects within the organization.

Recommendations For versions up to and including 1.2.2, update to version 1.2.7 to resolve the issue. As a temporary workaround, consider restricting the ability of admins to update user roles until the update can be applied.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2024-3504

Affected Products

Lunary

References · 8

• 🔥 https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28 · Exploit
• https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f · Patch
• https://osv.dev/vulnerability/CVE-2024-3504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3504 · Security Note
• https://twitter.com/CveFindCom/status/1798777189909058036 · Twitter Post
• https://t.me/cvenotify/97630 · Telegram Post
• https://t.me/cveNotify/138734 · Telegram Post
• https://twitter.com/CVEnew/status/1798781396703695326 · Twitter Post