CVE-2024-5127 Improper Access Control in lunary-ai/lunary

Medium 5.4 Published 6 Jun 2024 Updated 3 Nov 2024

Free plan users can invite others with elevated roles due to missing backend validation, allowing unauthorized access and modification of project settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-5127?

CVE-2024-5127 is a medium-severity missing authorization vulnerability in Lunary Lunary, published on 6 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.

Weakness: CWE-862

Which versions are affected by CVE-2024-5127?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-5127?

No fix has been published for CVE-2024-5127 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-5127 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5127 exists.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-4wgc-3r24-rc77.