Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-10274Improper Authorization in lunary-ai/lunary

Medium 6.5

In plain English

A medium-severity missing authorization in lunary-ai/lunary from lunary-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.0)6.5Medium

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy violations and potential reconnaissance for targeted attacks.

Affected products (as reported)

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	unspecified – before 1.5.7

Weakness: CWE-862 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected products (as reported)

References