High · published February 2, 2026
⚡ With just a sneaky tweak of an ID, users can delete prompts from other organizations in Lunary-AI version 1.2.13 — not cool! This access control flaw is like letting guests at a hotel invade each other's rooms just because they have keys to the doors — it’s a recipe for chaos! 🏨 If exploited, this vulnerability could lead to users removing vital prompts from other organizations, leaving legitimate users locked out of their critical data. Imagine the frustration when an important project gets derailed because someone inadvertently deleted the wrong prompts! It’s not just a nuisance; it could cause major information inconsistencies across projects.
This access control flaw is like letting guests at a hotel invade each other's rooms just because they have keys to the doors — it’s a recipe for chaos! 🏨 The issue arises because Lunary-AI fails to validate whether a prompt belongs to the user's organization before allowing deletion, relying solely on permission checks to delete resources. This oversight opens the door to unauthorized deletions.
If exploited, this vulnerability could lead to users removing vital prompts from other organizations, leaving legitimate users locked out of their critical data. Imagine the frustration when an important project gets derailed because someone inadvertently deleted the wrong prompts! It’s not just a nuisance; it could cause major information inconsistencies across projects. To protect against this, patch to version 1.2.14 as soon as possible, which addresses this access control vulnerability. Additionally, conduct a thorough audit of user permissions and implement stricter validation checks for ownership on delete operations. You’ve got this! Fixing this vulnerability will help safeguard your projects and keep your data safe. 🛡️