Is CVE-2024-6087 actively exploited?

No active exploitation of CVE-2024-6087 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-6087 be exploited remotely?

Yes. CVE-2024-6087 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-6087?

CVE-2024-6087 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2024-6087

MEDIUM

CVE-2024-6087

CWE-639Published: September 13, 2024· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability allows an attacker to use the auth tokens issued by the 'invite user' functionality to obtain valid JWT tokens. These tokens can be used to compromise target users upon registration for their own arbitrary organizations. The attacker can invite a target email, obtain a one-time use token, retract the invite, and later use the token to reset the password of the target user, leading to full account takeover.

NVD Source

Technical Analysis

CVE-2024-6087 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.