Improper Authorization Vulnerability in Lunary AI by Lunary Technologies

CVE-2024-10274

What is CVE-2024-10274?

An improper authorization vulnerability has been identified in Lunary AI, specifically in version 1.5.5. The affected /users/me/org endpoint fails to implement proper access control measures, enabling unauthorized users to gain access to sensitive information regarding all team members within the organization. This can include the disclosure of personal data such as names, roles, and emails of users who do not possess adequate privileges. The potential repercussions of this vulnerability include severe privacy infringements and the facilitation of reconnaissance efforts for targeted malicious attacks.

References