CVE-2024-3504

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.2

Description An improper access control issue exists, allowing an admin to update any organization user to the organization owner. This enables the elevated user to delete projects within the organization.

Recommendations For versions up to and including 1.2.2, update to version 1.2.7 to resolve the issue. As a temporary workaround, consider restricting the ability of admins to update user roles until the update can be applied.