What is CVE-2024-5714?

CVE-2024-5714 is a medium-severity vulnerability in Lunary, classified under Incorrect Authorization. CVSS score: 6.8/10. Published 2024-06-27.

How severe is CVE-2024-5714?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Is CVE-2024-5714 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Lunary

CVE-2024-5714

In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissions to manipulate project identifiers in requests, enabling them to invite users to projects in other organizations, change members to projects in other organizations with escalated privileges, and change members from other organizations to their own or other projects, also with escalated privileges. This vulnerability is due to the backend's failure to validate project identifiers against the current user's organization ID and projects belonging to it, as well as a misconfiguration in attribute naming (`org_id` should be `orgId`) that prevents proper user organization validation. As a result, attackers can cause inconsistencies on the platform for affected users and organizations, including unauthorized privilege escalation. The issue is present in the backend API endpoints for user invitation and modification, specifically in the handling of project IDs in requests.

Vulnerability class: Broken Access Control

Published 2024-06-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.005 (41.3th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Lunary — versions 1.2.4
Lunary-Ai Lunary-Ai/lunary — versions unspecified

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public proof-of-concept exploits

References

huntr.com/bounties/8cff4afa-131b-4a7e-9f0d-8a3c69f3d024 (Exploit, Third Party Advisory)
github.com/lunary-ai/lunary/commit/43206bacac3b43ad9f2db6dafd165e61a21e6b97

Frequently asked questions

What is CVE-2024-5714?: CVE-2024-5714 is a medium-severity vulnerability in Lunary, classified under Incorrect Authorization. CVSS score: 6.8/10. Published 2024-06-27.
How severe is CVE-2024-5714?: Medium severity. CVSS v3 base score is 6.8 out of 10.
Is CVE-2024-5714 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.