# CVE-2024-6087: Lunary improper access control in invite user functionality

Source: https://junglewise.ai/threats/cve-2024-6087-lunary-improper-access-control-in-invite-user-functionality  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6087 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an AI application monitoring and logging platform. A flaw in its user invitation system allows attackers to hijack authentication tokens meant for new users, enabling password resets and complete account takeover of arbitrary user accounts. The vulnerability has been withdrawn from the advisory database because it affects an unsupported package variant, though the underlying security issue remains valid.

Technologies: [lunary (npm)](https://junglewise.ai/threats/technologies/lunary). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-6087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6087 being exploited in the wild.

**How severe is CVE-2024-6087?** Low severity, with a CVSS score of 3, published 13 September 2024.

**Which products and versions are affected?** lunary (npm) SEMVER:introduced=0,fixed=1.4.9.

**Is there a fix for CVE-2024-6087?** Yes. lunary (npm): upgrade to 1.4.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6087 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-6087?** Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lunary (npm): upgrade to 1.4.9 or later

  ```sh
  npm install lunary@1.4.9
  ```


## Technical details

The vulnerability is an improper access control issue (CWE-284) in Lunary's user invitation flow. An attacker can intercept one-time-use auth tokens issued during the 'invite user' workflow, retract the invitation, and later reuse those tokens to reset passwords and obtain valid JWT tokens for arbitrary user accounts. The attack requires network access and does not require prior authentication, but does require knowledge of target email addresses. The advisory was withdrawn because the npm package "lunary" is disconnected from the vulnerable repository (lunary-ai/lunary); however, the underlying flaw in the auth token handling is documented as fixed in commit 844e8855c7a713dc7371766dba4125de4007b1cf.

## Affected products

- Lunary AI Lunary prior to 1.4.9

## Identifiers

- CVE-2024-6087
- GHSA-6p2q-8qfq-wq7x

## Timeline

- 2024-09-13: disclosed
- 2024-09-13: patched: Fix available in commit 844e8855c7a713dc7371766dba4125de4007b1cf; version 1.4.9 or later
- 2025-06-20: other: Advisory withdrawn from GitHub Advisory Database due to package ecosystem mismatch

## References

- [https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf](https://github.com/lunary-ai/lunary/commit/844e8855c7a713dc7371766dba4125de4007b1cf)

## Related threats

- [Lunary information disclosure in runs endpoint](https://junglewise.ai/threats/cve-2024-6867-lunary-information-disclosure-in-runs-endpoint)
- [Lunary Cross-Site Request Forgery in CORS](https://junglewise.ai/threats/cve-2024-6862-lunary-cross-site-request-forgery-in-cors)
- [Lunary improper authentication in SAML configuration](https://junglewise.ai/threats/cve-2024-6582-lunary-improper-authentication-in-saml-configuration)
- [Lunary-ai Lunary access control bypass in prompt variation management](https://junglewise.ai/threats/lunary-ai-lunary-access-control-bypass-in-prompt-variation-management-cd347a2d)
- [lunary-ai lunary authorization bypass in project access](https://junglewise.ai/threats/cve-2024-4146-lunary-ai-lunary-authorization-bypass-in-project-access)