CVE-2024-7476CWE-639

Broken Access Control in lunary-ai/lunary

Medium · published March 20, 2025

CVSS v3.0
4.3
EPSS
2%
Percentile
74.3
In the wild
Unconfirmed
What it is

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01510 · 74.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-03-20T10:09Z
EPSS history
Timeline
  • 20 MAR 10:09Z
    Broken Access Control in lunary-ai/lunary
    cvelistv5