CVE-2024-10274

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.5.5

Description An improper authorization issue exists due to inadequate access control mechanisms in the "/users/me/org" endpoint, allowing unauthorized users to access sensitive team member information, including names, roles, and emails, which can lead to privacy violations and potential targeted attacks.

Recommendations For lunary-ai/lunary version 1.5.5, consider restricting access to the "/users/me/org" endpoint until a patch is available, and review the access control mechanisms to ensure they are adequate to prevent unauthorized access.