Is CVE-2024-6087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-6087 being exploited in the wild.

How severe is CVE-2024-6087?

Low severity, with a CVSS score of 3, published 13 September 2024.

Which products and versions are affected?

lunary (npm) SEMVER:introduced=0,fixed=1.4.9.

Is there a fix for CVE-2024-6087?

Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-6087 attacked?

It is attacked over the network.

Am I affected by CVE-2024-6087?

Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-6087: Lunary improper access control in invite user functionality

CVE-2024-6087 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an AI application monitoring and logging platform. A flaw in its user invitation system allows attackers to hijack authentication tokens meant for new users, enabling password resets and complete account takeover of arbitrary user accounts. The vulnerability has been withdrawn from the advisory database because it affects an unsupported package variant, though the underlying security issue remains valid.

Technologies: lunary (npm). Vendors: npm.

Quick answers

Is CVE-2024-6087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-6087 being exploited in the wild.
How severe is CVE-2024-6087?: Low severity, with a CVSS score of 3, published 13 September 2024.
Which products and versions are affected?: lunary (npm) SEMVER:introduced=0,fixed=1.4.9.
Is there a fix for CVE-2024-6087?: Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-6087 attacked?: It is attacked over the network.
Am I affected by CVE-2024-6087?: Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lunary (npm): upgrade to 1.4.9 or later
```
npm install lunary@1.4.9
```

Technical details

The vulnerability is an improper access control issue (CWE-284) in Lunary's user invitation flow. An attacker can intercept one-time-use auth tokens issued during the 'invite user' workflow, retract the invitation, and later reuse those tokens to reset passwords and obtain valid JWT tokens for arbitrary user accounts. The attack requires network access and does not require prior authentication, but does require knowledge of target email addresses. The advisory was withdrawn because the npm package "lunary" is disconnected from the vulnerable repository (lunary-ai/lunary); however, the underlying flaw in the auth token handling is documented as fixed in commit 844e8855c7a713dc7371766dba4125de4007b1cf.

Affected products

Lunary AI Lunary prior to 1.4.9

Identifiers

CVE-2024-6087
GHSA-6p2q-8qfq-wq7x

Timeline

2024-09-13: disclosed
2024-09-13: patched: Fix available in commit 844e8855c7a713dc7371766dba4125de4007b1cf; version 1.4.9 or later
2025-06-20: other: Advisory withdrawn from GitHub Advisory Database due to package ecosystem mismatch

References

https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.