Unauthorized Access to Sensitive Information in Lunary Version v1.2.13

CVE-2024-4146

What is CVE-2024-4146?

The Lunary AI project management tool contains an authorization vulnerability that grants unauthorized users the ability to access and manipulate projects within organizations. This security flaw resides in the checkProjectAccess method of the authorization middleware, where it inadequately validates user permissions for specific projects. Instead of performing a thorough verification, it only checks whether the user belongs to the organization associated with the project, neglecting to confirm the user's explicit project access rights through the account_project table. As a result, this oversight allows attackers to exercise full control over the project's resources, including the ability to create, read, update, or delete sensitive information, thereby jeopardizing the security and confidentiality of organizational data.

References