What’s Vulnerable › Vulnerabilities

CVE-2024-5126: Improper Access Control in lunary-ai/lunary

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-862

Description

An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in version 1.2.25.

Affected products

• lunary-ai/lunary: from 1.2.2 before 1.2.25 — fixed in 1.2.25

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.2.25. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297
• https://huntr.com/bounties/8e7e1267-ea6c-4789-b9dc-3410dfac6ec6
• https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297
• https://huntr.com/bounties/8e7e1267-ea6c-4789-b9dc-3410dfac6ec6

Get alerted when CVE-2024-5126 or the next vulnerability affects your stack