CVE-2024-10272: lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of…

PriorityP345high7.5CVSS 3.0

AVNACLPRNUINSUCHINAN

EPSS

0.56%

42.4th percentile

lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lunary-ai	lunary-ai_lunary	>= unspecified < 1.4.9	1.4.9
lunary	lunary	< 1.4.9	1.4.9

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.