An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lunary |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-32090 | An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 15 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Wed, 15 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-863 |
Tue, 15 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Wed, 09 Oct 2024 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lunary
Lunary lunary |
|
| Weaknesses | NVD-CWE-noinfo | |
| CPEs | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Lunary
Lunary lunary |
|
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2025-10-15T12:49:37.495Z
Reserved: 2024-04-09T02:08:37.707Z
Link: CVE-2024-3504
Vulnrichment
Updated: 2024-08-01T20:12:07.852Z
NVD
Status : Modified
Published: 2024-06-06T18:15:17.980
Modified: 2025-10-15T13:15:43.507
Link: CVE-2024-3504
Redhat
No data.
OpenCVE Enrichment
No data.