{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-05T21:25:14.911","vulnerabilities":[{"cve":{"id":"CVE-2024-3504","sourceIdentifier":"security@huntr.dev","published":"2024-06-06T18:15:17.980","lastModified":"2026-06-17T07:44:24.463","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7."},{"lang":"es","value":"Existe una vulnerabilidad de control de acceso inadecuado en las versiones lunary-ai/lunary hasta la 1.2.2 incluida, donde un administrador puede actualizar cualquier usuario de la organización al propietario de la organización. Esta vulnerabilidad permite al usuario elevado eliminar proyectos dentro de la organización. El problema se resuelve en la versión 1.2.7."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"lunary-ai","product":"lunary-ai/lunary","versions":[{"version":"unspecified","lessThan":"1.2.7","versionType":"custom","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"lunary-ai","product":"lunary","defaultStatus":"affected","cpes":["cpe:2.3:a:lunary-ai:lunary:*:*:*:*:*:*:*:*"],"versions":[{"version":"unspecified","lessThanOrEqual":"1.2.7","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.2}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-06-06T18:37:22.088363Z","id":"CVE-2024-3504","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]},{"source":"nvd@nist.gov","type":"Secondary","description":[{"lang":"en","value":"NVD-CWE-noinfo"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.7","matchCriteriaId":"E6989773-CA2D-46FD-AEA6-E6D6F2C01B17"}]}]}],"references":[{"url":"https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}