CVE-2024-3504CWE-863

Improper Access Control in lunary-ai/lunary

High · published June 6, 2024

CVSS v3.0
8.1
EPSS
0%
Percentile
41.5
In the wild
Unconfirmed
What it is

An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00494 · 41.5th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-06-06T17:53Z
EPSS history
Timeline
  • 06 JUN 17:53Z
    Improper Access Control in lunary-ai/lunary
    cvelistv5