CVE-2024-4146 json
Incorrect Authorization in lunary-ai/lunary
published 2024-06-08 2 y ago modified 2026-09-10 1 mo ago also GHSA-w5xm-mx47-v7c8 , EUVD-2024-2187
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
In lunary-ai/lunary version v1.2.13, an incorrect authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/a749e696-b398-4260-b2d0-b0054b9fffa7 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- lunary-ai lunary-ai/lunary
- lunary lunary
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7
web, patch
-
huntr.com
/bounties/a749e696-b398-4260-b2d0-b0054b9fffa7
web, exploit, issue-tracking
-
nvd.nist.gov
/vuln/detail/CVE-2024-4146
advisory
-
github.com
/lunary-ai/lunary
package
Sources
- CVE List CVE-2024-4146
- GitHub Advisory GHSA-w5xm-mx47-v7c8
- NVD CVE-2024-4146
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.