CVE-2024-10275

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manag...

CVE-2024-10275

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manag...

CVE-2024-10275 Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manag...

CVE-2024-10275 Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary

In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permissions of existing users to include billing permissions. This can lead to a privilege escalation scenario where an administrator can manag...

CVE-2024-10275

CVE-2024-10275 affects lunary-ai/lunary (v1.5.5). Multiple connected sources confirm an improper privilege management flaw where admins can grant billing permissions to existing users, enabling privilege escalation to access billing resources and bypass RBAC. Root cause: admins without direct bil...

CVE-2024-10273 Improper Privilege Management in lunary-ai/lunary

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...

Lunary 访问控制错误漏洞

Lunary is Lunary open source a production toolkit for LLM . Lunary has a security vulnerability that stems from improper privilege management, which can be exploited by an attacker to cause an administrator to bypass role controls to access billing information...

lunary 访问控制错误漏洞

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in lunary that stems from a user-created endpoint that does not restrict administrators from inviting users with billing roles, which can be exploited by an attacker to cause unauthorized access...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in model/role.go. A user with the Viewer role, configured with No Access to Reporting, can access team and site statistics. Remediation Upgrade github.com/mattermost/mattermost/server/public/model to version 0.1....

GHSA-FQRQ-XMXJ-V47X Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

Mattermost Fails to Properly Perform Viewer Role Authorization

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

CVE-2025-1472

CVE-2025-1472 corresponds to Mattermost where versions 9.11.x up to 9.11.8 suffer from an authorization flaw in the Viewer role (configured with No Access to Reporting) that allows viewing team/site statistics. The CVE entry indicates a CVSSv3.1 base score of 4.3 (Medium) with Network attack vect...

CVE-2025-1472 Unauthorized View Access to Site Statistics and Team Statistics

Mattermost versions 9.11.x = 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an authorization issue vulnerability that stems from improper authorization of the Viewer role, which can be exploited by an attacker to still view team and site statistics...

CVE-2025-29781

A flaw was found in the Bare Metal Operator BMO Kubernetes API component. BMO enables users to load Secrets from arbitrary namespaces upon deployment of the namespace-scoped Custom Resource BMCEventSubscription. In affected versions, an adversary using a Kubernetes account with only namespace lev...

CVE-2025-2232

The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'doregisteruser' function. This makes it possible for...

CVE-2025-2103

The SoundRise Music plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on theironMusicajax function in all versions up to, and including, 1.6.11. This makes it possible for authenticated attackers, with...

CVE-2025-2232

The Realteo - Real Estate Plugin by Purethemes plugin for WordPress, used by the Findeo Theme, is vulnerable to authentication bypass in all versions up to, and including, 1.2.8. This is due to insufficient role restrictions in the 'doregisteruser' function. This makes it possible for...