What’s Vulnerable › Vulnerabilities

CVE-2024-7473: IDOR Vulnerability in lunary-ai/lunary

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-29 · updated 2026-06-17
• Weakness: CWE-639

Description

An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerability allows an authenticated user to update other users' prompts by manipulating the 'id' parameter in the request. The issue is fixed in version 1.4.3.

Affected products

• lunary-ai/lunary: 1.3.2

References

• https://github.com/lunary-ai/lunary/commit/88b55b01fcbab0fbbc5b8032a38d0345af98ecfa
• https://huntr.com/bounties/afecd927-b5f6-44ba-9147-5c45091beda5

Get alerted when CVE-2024-7473 or the next vulnerability affects your stack