Unauthorized Access to Sensitive Information in Lunary Version v1.2.13

CVE-2024-4146

What is CVE-2024-4146?

The Lunary AI project management tool contains an authorization vulnerability that grants unauthorized users the ability to access and manipulate projects within organizations. This security flaw resides in the checkProjectAccess method of the authorization middleware, where it inadequately validates user permissions for specific projects. Instead of performing a thorough verification, it only checks whether the user belongs to the organization associated with the project, neglecting to confirm the user's explicit project access rights through the account_project table. As a result, this oversight allows attackers to exercise full control over the project's resources, including the ability to create, read, update, or delete sensitive information, thereby jeopardizing the security and confidentiality of organizational data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References