CVE-2024-10274: An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing…

PriorityP337medium6.5CVSS 3.0

AVNACLPRLUINSUCHINAN

EPSS

0.50%

38.7th percentile

An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing unauthorized users to access sensitive information about all team members in the current organization. This vulnerability can lead to the disclosure of sensitive information such as names, roles, or emails to users without sufficient privileges, resulting in privacy violations and potential reconnaissance for targeted attacks.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lunary-ai	lunary-ai_lunary	>= unspecified < 1.5.7	1.5.7
lunary	lunary	< 1.5.7	1.5.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.