Skip to content
Fencer Vulns
high 7.3

CVE-2024-10275 json

Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary

published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7117

cvss
7.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manage billing, effectively bypassing the intended role-based access control. Only users with the 'owner' role should be allowed to invite members with billing permissions. This flaw allows admins to circumvent those restrictions, gaining unauthorized access and control over billing information, posing a risk to the organization’s financial resources.

Patch / fix

  • lunary-ai lunary-ai/lunary 1.5.7

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
19 mo ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/863ee34b-c4c6-4325-bf7a-82a7feebf88f referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected products

  • lunary-ai lunary-ai/lunary

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.