PT-2024-35957 · Lunary+1 · Lunary+1

Published 2024-10-17 · Updated 2026-02-11 · CVE-2024-5386

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.2

Description A security issue exists in lunary-ai/lunary version 1.2.2 that allows account hijacking. A user with a 'viewer' role can obtain a password reset token by sending a specific request to the server. The token is returned in the recoveryToken parameter. This token can then be used to reset the password of another user's account without authorization, leading to account takeover. The root cause is an excessive attack surface that allows lower-privileged users to escalate their privileges.

Recommendations Apply a fix to prevent 'viewer' role users from obtaining password reset tokens.

Fix

LPE

Weakness Enumeration

CWE-1125

Related Identifiers

CVE-2024-5386

Affected Products

Lunary

Lunary-Ai/Lunary

References · 8

• https://osv.dev/vulnerability/CVE-2024-5386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5386 · Security Note
• https://huntr.com/bounties/602eb4a1-305d-46d6-b975-5a5d8b040ad1 · Patch
• https://t.me/CVEtracker/43488 · Telegram Post
• ❌ https://github.com/lunary-ai/lunary/commit/fc7ab3d5621c18992da5dab3a2a9a8d227d42311 · Note, Deleted
• https://twitter.com/0dayPublishing/status/2018277329282171196 · Twitter Post
• https://t.me/cveNotify/151773 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1846808490079052208 · Twitter Post