A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.
Metrics
Affected Vendors & Products
References
History
Wed, 15 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-284 |
Wed, 15 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-639 |
Wed, 02 Jul 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lunary
Lunary lunary |
|
| CPEs | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Lunary
Lunary lunary |
Thu, 20 Mar 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3. | |
| Title | Broken Access Control in lunary-ai/lunary | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:09:59.839Z
Updated: 2025-10-15T12:49:51.255Z
Reserved: 2024-08-04T14:24:46.424Z
Link: CVE-2024-7476
Vulnrichment
Updated: 2025-03-20T17:49:42.310Z
NVD
Status : Modified
Published: 2025-03-20T10:15:36.467
Modified: 2025-10-15T13:15:52.470
Link: CVE-2024-7476
Redhat
No data.