{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-03T04:54:45.481","vulnerabilities":[{"cve":{"id":"CVE-2024-4154","sourceIdentifier":"security@huntr.dev","published":"2024-05-21T18:15:09.987","lastModified":"2026-06-17T08:01:14.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In lunary-ai/lunary version 1.2.2, an incorrect synchronization vulnerability allows unprivileged users to rename projects they do not have access to. Specifically, an unprivileged user can send a PATCH request to the project's endpoint with a new name for a project, despite not having the necessary permissions or being assigned to the project. This issue allows for unauthorized modification of project names, potentially leading to confusion or unauthorized access to project resources."},{"lang":"es","value":"En lunary-ai/lunary versión 1.2.2, una vulnerabilidad de sincronización incorrecta permite a usuarios sin privilegios cambiar el nombre de proyectos a los que no tienen acceso. Específicamente, un usuario sin privilegios puede enviar una solicitud PATCH al endpoint del proyecto con un nuevo nombre para un proyecto, a pesar de no tener los permisos necesarios o no estar asignado al proyecto. Este problema permite la modificación no autorizada de los nombres de los proyectos, lo que podría generar confusión o acceso no autorizado a los recursos del proyecto."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"lunary-ai","product":"lunary-ai/lunary","versions":[{"version":"unspecified","lessThan":"1.2.26","versionType":"custom","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"lunary-ai","product":"lunary","defaultStatus":"unknown","cpes":["cpe:2.3:a:lunary-ai:lunary:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.2.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-21T18:30:28.034562Z","id":"CVE-2024-4154","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]},{"source":"nvd@nist.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.26","matchCriteriaId":"8B6E136A-BD63-4012-9F3F-A388E67219EA"}]}]}],"references":[{"url":"https://github.com/lunary-ai/lunary/commit/c43b6c62035f32ca455f66d5fd22ba661648cde7","source":"security@huntr.dev"},{"url":"https://huntr.com/bounties/e56509af-f7af-4e1e-a04b-9cb53545f30f","source":"security@huntr.dev","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://huntr.com/bounties/e56509af-f7af-4e1e-a04b-9cb53545f30f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]}]}}]}