Is CVE-2024-5127 actively exploited?

No active exploitation of CVE-2024-5127 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-5127 be exploited remotely?

Yes. CVE-2024-5127 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-5127?

CVE-2024-5127 has a CVSS score of 5.4 (MEDIUM).

HOME VULNERABILITIESCVE-2024-5127

MEDIUM

CVE-2024-5127

CWE-862Published: June 6, 2024· Updated: Jun 17, 2026

5.4

CVSS v3.1

Official Description

In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.

NVD Source

Technical Analysis

CVE-2024-5127 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.