CVE-2024-4151CWE-639

Improper Access Control in lunary-ai/lunary

High · published May 20, 2024

CVSS v3.0
8.3
EPSS
0%
Percentile
32.0
In the wild
Unconfirmed
What it is

An Improper Access Control vulnerability exists in lunary-ai/lunary version 1.2.2, where users can view and update any prompts in any projects due to insufficient access control checks in the handling of PATCH and GET requests for template versions. This vulnerability allows unauthorized users to manipulate or access sensitive project data, potentially leading to data integrity and confidentiality issues.

The record
Technical detail
CVSS v3.0
8.3 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00391 · 32.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2024-05-20T14:14Z
EPSS history
Timeline
  • 20 MAY 14:14Z
    Improper Access Control in lunary-ai/lunary
    cvelistv5