What’s Vulnerable › Vulnerabilities

CVE-2024-5130: Incorrect Authorization in lunary-ai/lunary

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-862

Description

An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.

Affected products

• lunary-ai/lunary: before 1.2.8 — fixed in 1.2.8

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.2.8. Check the vendor advisory for mitigations.

References

• https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
• https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe
• https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
• https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe

Get alerted when CVE-2024-5130 or the next vulnerability affects your stack