CVE-2024-1740

CVE-2024-1740 describes a critical authorization bypass vulnerability in lunary-ai/lunary version 1.0.1. A user removed from an organization can retain unauthorized access to logs and sensitive project details by reusing an old authorization token, as the web application fails to invalidate these tokens upon removal. This flaw allows removed users to read, create, modify, and delete logs, and access project and external user information without valid permissions. The vulnerability carries a CVSS score of 9.1 (CRITICAL), indicating a high-impact attack that can be executed remotely with low complexity, leading to significant confidentiality and integrity breaches. While the EPSS score is low, suggesting a lower likelihood of exploitation compared to many CVEs, the FAUCET Risk Score of 72/100 highlights its considerable risk. Currently, there is no evidence of active exploitation, and no public exploit code or Metasploit/Nuclei modules are available. Community discussion and media coverage for this CVE are minimal, which is typical for a large percentage of reported vulnerabilities.