In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Lunary |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-2187 | In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information. |
 Github GHSA |
GHSA-w5xm-mx47-v7c8 | lunary-ai/lunary allows users unauthorized access to projects |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 30 Aug 2024 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-285 | |
| Metrics |
cvssV3_0
|
Fri, 30 Aug 2024 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Improper Authorization in lunary-ai/lunary | Incorrect Authorization in lunary-ai/lunary |
Fri, 30 Aug 2024 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In lunary-ai/lunary version v1.2.13, an improper authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information. | In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information. |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-30T15:28:58.378Z
Reserved: 2024-04-24T20:53:36.842Z
Link: CVE-2024-4146
Vulnrichment
Updated: 2024-08-01T20:33:52.530Z
NVD
Status : Modified
Published: 2024-06-08T20:15:52.117
Modified: 2024-11-21T09:42:16.633
Link: CVE-2024-4146
Redhat
No data.
OpenCVE Enrichment
No data.