Auth bypass in Lunary
CVE-2024-5129
A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
Vulnerability class: Broken Access Control
EPSS: 0.004 (36.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L.
Affected products
- Lunary
- Lunary-ai Lunary-ai/lunary — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Patch, Third Party Advisory, Issue Tracking)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-5129?
- CVE-2024-5129 is a high-severity vulnerability in Lunary, classified under Missing Authorization. CVSS score: 8.2/10. Published 2024-06-06.
- How severe is CVE-2024-5129?
- High severity. CVSS v3 base score is 8.2 out of 10.
- Is CVE-2024-5129 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.