Auth bypass in Lunary
CVE-2024-5130
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
Vulnerability class: Broken Access Control
EPSS: 0.005 (39.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Lunary
- Lunary-ai Lunary-ai/lunary — versions unspecified
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@huntr.dev (Exploit, Patch, Third Party Advisory, Issue Tracking)
- security@huntr.dev (Patch)
Frequently asked questions
- What is CVE-2024-5130?
- CVE-2024-5130 is a high-severity vulnerability in Lunary, classified under Missing Authorization. CVSS score: 7.5/10. Published 2024-06-06.
- How severe is CVE-2024-5130?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2024-5130 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.