VULNERABILITY INTELLIGENCE

CVE-2024-6582

CVSS score4.3 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2024-09-13
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.

Weakness classification

  • security@huntr.dev: CWE-306
  • nvd@nist.gov: CWE-306

Primary references