CVE-2024-10275

Katalog CVE

CVSS 7.3 · High EPSS 0,51%

Kerentanan Incorrect Authorization pada lunary. Skor CVSS 3.0 7.3 (High) menurut huntr.dev.

Deskripsi (NVD)

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite members with billing permissions. This flaw allows admins to circumvent those restrictions, gaining unauthorized access and control over billing information, posing a risk to the organization’s financial resources.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.0

7.3 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,51% peluang dieksploitasi; lebih tinggi dari 41,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc patch
• https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f exploit · advisory pihak ketiga