VULNERABILITY INTELLIGENCE

CVE-2024-6086

CVSS score4.3 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2024-06-27
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improper access control. The function checkAccess() is not implemented, allowing users with the lowest privileges, such as the 'Prompt Editor' role, to modify organization attributes without proper authorization.

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references