PT-2025-12267 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9098

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions prior to 1.4.30

Description The issue arises from the user creation endpoint not restricting administrators from inviting users with billing roles, allowing them to gain unauthorized access to billing resources. This poses a risk to the organization's financial resources as administrators can circumvent the intended access control.

Recommendations For versions prior to 1.4.30, update to version 1.4.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the user creation endpoint to prevent administrators from inviting users with billing roles.

Exploit

Fix

LPE

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

CVE-2024-9098

Affected Products

Lunary

References · 5

• 🔥 https://huntr.com/bounties/75d466ae-8591-44d5-9160-eea7cad0c4fc · Exploit
• https://github.com/lunary-ai/lunary/commit/a8d7b2959e87c30fbafdb12af7ffa093385dcc60 · Patch
• https://osv.dev/vulnerability/CVE-2024-9098 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9098 · Security Note
• https://twitter.com/CVEnew/status/1902968882815701056 · Twitter Post