Unauthorized Organization Access in lunary-ai/lunary
Priority HIGH 80CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0068 52nd percentileScored 2026-11-07
Fix Fixed lunary-ai/lunary (lunary-ai): 1.2.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lunary-ai | lunary-ai/lunary | before 1.2.2 | 1.2.2 | Patch available | CNA |
- lunary-ai/lunary Vendorlunary-ai Affected before 1.2.2 Fixed in 1.2.2 Patch available CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lunary-ai:lunary-ai\/lunary:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:lunary-ai:lunary-ai\/lunary:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA lunary-ai/lunary (lunary-ai) Fixed in 1.2.2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-1643
- 2026-10-03 Alias added: GHSA-xw8r-2c2x-7j88
References
More lunary-ai vulnerabilities
- TI-2024-08445 Improper Authorization in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
- TI-2024-06910 SQL Injection in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
- TI-2024-03859 Incorrect Authorization in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
- TI-2024-06928 Improper Access Control in lunary-ai/lunary CVSS 3.1CRITICAL 9.1
- TI-2024-03267 Exposure of Sensitive Information in lunary-ai/lunary CVSS 3.1CRITICAL 9.1
- TI-2024-03266 Exposure of Sensitive Information in lunary-ai/lunary CVSS 3.1CRITICAL 9.1
Sources
- CVE-2024-1643 · CVE Program
- CVE-2024-1643 · NVD
- FIRST EPSS
- GHSA-xw8r-2c2x-7j88 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences