Critical · published March 20, 2025
🚨 A logged-in user can tap into the /bigquery API and grab the entire database like it's a buffet, all without breaking a sweat! 🔥 Think of it as a restaurant where anyone with a reservation can waltz into the kitchen and feast on all the secret recipes, including the chef's most prized dishes — sensitive data like password hashes and API keys! This vulnerability is absolutely devastating; it could allow an attacker to extract sensitive data, compromise credentials, and disrupt services. Imagine a thief walking away with the entire menu and special ingredients during peak service hours — total chaos!
Think of it as a restaurant where anyone with a reservation can waltz into the kitchen and feast on all the secret recipes, including the chef's most prized dishes — sensitive data like password hashes and API keys! In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery, exposing sensitive data without verifying user permissions.
This vulnerability is absolutely devastating; it could allow an attacker to extract sensitive data, compromise credentials, and disrupt services. Imagine a thief walking away with the entire menu and special ingredients during peak service hours — total chaos! Immediately patch to version v1.4.29 to implement proper access control middleware. Also, review and restrict user permissions for sensitive API routes to ensure only authorized users can perform exports. 🔒 This is fixable! Act now and you'll have your defenses back up in no time. 🛡️