lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2024-04-10T17:08:05.267Z
Updated: 2024-04-16T11:10:33.420Z
Reserved: 2024-02-26T19:31:07.972Z
Link: CVE-2024-1902
JSON object: View
NVD Information
Status : Awaiting Analysis
Published: 2024-04-10T17:15:53.680
Modified: 2024-04-15T18:15:10.070
Link: CVE-2024-1902
JSON object: View
Redhat Information
No data.
CWE