CVE-2024-7474: IDOR in lunary-ai/lunary

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-10-29 · updated 2026-06-17
Weakness: CWE-639

Description

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

Affected products

lunary-ai/lunary: before 1.3.4 — fixed in 1.3.4

How to fix

Upgrade to a fixed version: lunary-ai/lunary 1.3.4. Check the vendor advisory for mitigations.

References

https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5
https://huntr.com/bounties/95d8b993-3347-4ef5-a2b3-1f57219b7871

Get alerted when CVE-2024-7474 or the next vulnerability affects your stack