The vulnerability stems from inadequate verification of user roles when updating user information, specifically the role attribute. The system's failure to properly restrict role updates to authorized personnel (e.g., only allowing the organization's owner to make such changes) means that an admin, who should not have the authority to promote users to the owner level, can do so. This oversight can lead to unauthorized organizational control, including the deletion of critical projects.

An attacker with administrative access to the lunary-ai/lunary platform could exploit this vulnerability by sending a PATCH request to the user update endpoint, specifying a target user's ID and changing their role to 'owner'. This action would grant the targeted user all privileges associated with the owner role, including the ability to delete projects within the organization.

Organizations using lunary-ai/lunary version 1.2.2 are affected by this vulnerability. Specifically, this issue impacts organizations with multiple users, where unauthorized elevation of a user's role can lead to significant operational risks, including the unauthorized deletion of projects.