https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T00:04:03.355248+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2025-09696 cnvd-2025-09696 2026-10-09T00:04:03.358010+00:00 cnvd-2025-09696 https://cve.radiocsirt.org/vuln/euvd-2026-199054 EUVD-2026-199054 2026-10-09T00:04:03.358049+00:00 EUVD-2026-199054 https://cve.radiocsirt.org/vuln/fkie_cve-2024-6582 fkie_cve-2024-6582 2026-10-09T00:04:03.358063+00:00

A broken access control vulnerability exists in the latest version of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.

 https://cve.radiocsirt.org/vuln/ghsa-w73r-8mm4-cfvf Withdrawn: GHSA-w73r-8mm4-cfvf — Withdrawn Advisory: Lunary Improper Authentication vulnerability 2026-10-09T00:04:03.358095+00:00

Withdrawn by the publisher.

Affected: npm: lunary

# Withdrawn Advisory

This advisory was incorrectly linked the the npm package `lunary`. The advisory is valid, but not for that package.

# Original Advisory

A broken access control vulnerability exists prior to commit 1f043d8798ad87346dfe378eea723bff78ad7433 of lunary-ai/lunary. The `saml.ts` file allows a user from one organization to update the Identity Provider (IDP) settings and view the SSO metadata of another organization. This vulnerability can lead to unauthorized access and potential account takeover if the email of a user in the target organization is known.