Billing privilege escalation via unchecked role change

Incorrect authorization in Lunary before 1.5.7 allows remote authenticated users with administrator access to grant billing permissions. The PATCH /v1/users/:userId handler accepted the billing role without verifying that the requesting account held the owner role. An existing administrator account and a target user in the same organization are required; the modified account gains access to billing data and controls.