What’s Vulnerable › Vulnerabilities

CVE-2024-10273: Improper Privilege Management in lunary-ai/lunary

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-863

Description

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to modify. This vulnerability could lead to unauthorized changes in critical resources, affecting the integrity and reliability of the system.

Affected products

• lunary-ai/lunary: before 1.5.7 — fixed in 1.5.7

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.5.7. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
• https://huntr.com/bounties/883d9fe2-5730-41e1-a5c2-59972489876e

Get alerted when CVE-2024-10273 or the next vulnerability affects your stack