CVE-2024-10330: Improper Access Control in lunary-ai/lunary

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-862

Description

In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.

Affected products

lunary-ai/lunary: before 1.5.7 — fixed in 1.5.7

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.5.7. Check the vendor advisory for mitigations.

References

https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc
https://huntr.com/bounties/598ecd65-1723-4fb7-a9aa-9c4f56a5a2aa

Get alerted when CVE-2024-10330 or the next vulnerability affects your stack