CVE-2024-5127: Improper Access Control in lunary-ai/lunary
First published: Thu Jun 06 2024(Updated: )
In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| lunary lunary | >=1.2.2<1.2.25 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-5127?
CVE-2024-5127 is considered a high severity vulnerability due to improper access controls affecting user roles.
How can I fix CVE-2024-5127?
To fix CVE-2024-5127, upgrade to a version of lunary that is above 1.2.25, where this vulnerability has been addressed.
Who is affected by CVE-2024-5127?
CVE-2024-5127 affects users on the Free plan of lunary versions 1.2.2 through 1.2.25.
What type of vulnerability is CVE-2024-5127?
CVE-2024-5127 is classified as an improper access control vulnerability.
What impact does CVE-2024-5127 have on users?
CVE-2024-5127 allows Free plan users to invite others and assign them roles reserved for Paid and Enterprise plan members.
- agent/references
- agent/title
- agent/first-publish-date
- agent/description
- agent/type
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lunary
- canonical/lunary lunary
- version/lunary lunary/1.2.2