CVE-2024-10275 Overview
CVE-2024-10275 is an authorization flaw [CWE-863] affecting lunary-ai/lunary version 1.5.5. Administrators without direct access to billing resources can modify existing user permissions to include billing rights. This action bypasses the role-based access control (RBAC) design, which restricts billing invitations to users holding the owner role. An admin exploiting this weakness can grant billing access to themselves or other accounts and manage financial resources without authorization.
Critical Impact
Admins can escalate privileges to control billing operations, exposing organizational financial data and payment configuration to unauthorized modification.
Affected Products
- Lunary AI lunary version 1.5.5
- Deployments using the affected RBAC permission-assignment logic
- Self-hosted Lunary instances prior to the patched commit
Discovery Timeline
- 2025-03-20 - CVE-2024-10275 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10275
Vulnerability Analysis
The vulnerability resides in the permission-update workflow of Lunary. The application enforces that only users with the owner role can invite new members carrying billing permissions. However, the same restriction is not applied when an existing user's permissions are modified. An account with the admin role can call the permission-update endpoint and add billing scopes to any user record, including their own.
The result is a horizontal-to-vertical privilege escalation. Admins effectively acquire owner-level financial control without invoking the invitation flow that would normally block them. Because billing endpoints trust the permission flag rather than the role hierarchy, subsequent billing operations succeed with the escalated permissions.
Root Cause
The root cause is inconsistent authorization enforcement across two related code paths. The invitation endpoint validates the caller's role before granting billing scopes, while the permission-modification endpoint validates only that the caller holds administrative rights. This gap constitutes a broken access control condition classified under CWE-863: Incorrect Authorization.
Attack Vector
Exploitation requires network access to the Lunary API and an authenticated admin account. The attacker sends a permission-update request targeting a user record and includes billing scopes in the payload. User interaction is required to the extent that an admin credential is used to submit the request. Once the update succeeds, the attacker can invoke billing endpoints to view invoices, change payment details, or modify subscription tiers.
A verified proof-of-concept is documented in the Huntr Bounty Report. No public exploit toolkit is currently tracked for this issue.
Detection Methods for CVE-2024-10275
Indicators of Compromise
- Permission-update API calls originating from admin accounts that add billing scopes to user records
- Newly granted billing permissions on accounts that were not invited through the owner-driven flow
- Unexpected access to billing endpoints such as invoice retrieval, payment method updates, or subscription changes from non-owner users
Detection Strategies
- Audit application logs for permission mutations where the target permission set includes billing scopes and the invoking role is admin rather than owner
- Compare current user permission matrices against baseline role definitions to identify accounts that hold billing rights outside the expected owner group
- Correlate permission changes with subsequent billing endpoint access to identify exploitation chains
Monitoring Recommendations
- Enable verbose API access logging on Lunary and forward events to a centralized log platform for retention and search
- Alert on any modification to billing-related permission flags, regardless of the source role
- Review administrative activity on a scheduled cadence and validate that billing scope assignments align with the owner-only policy
How to Mitigate CVE-2024-10275
Immediate Actions Required
- Upgrade Lunary to a version that includes the fix committed in commit 8ba1b8b
- Audit current user permissions and revoke billing scopes from any account that does not hold the owner role
- Rotate credentials for admin accounts if unauthorized permission changes are identified
Patch Information
The maintainers addressed the flaw in the upstream repository. The fix aligns the permission-update endpoint with the invitation endpoint by rejecting billing scope changes unless the caller holds the owner role. Review the GitHub commit for implementation details and apply the corresponding release to all affected deployments.
Workarounds
- Restrict network access to the Lunary API so that only trusted operators can reach permission-management endpoints
- Reduce the number of accounts holding the admin role until the patch is deployed
- Implement an out-of-band approval process for any billing permission change and reconcile against application logs
# Verify installed Lunary version and pull the patched release
git -C /opt/lunary log --oneline | grep 8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
git -C /opt/lunary pull origin main
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
