Improper authorization in lunary-ai/lunary (CVE-2024-10274)
Date: 2024
Affected: lunary-ai/lunary 1.5.5
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High

lunary-ai/lunary 1.5.5 /users/me/org endpoint lacks adequate access control, allowing unauthorized users to access sensitive organization information.


Mitigations:

Architectural layers (MAESTRO):