CVE-2024-7476: A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any…

PriorityP425medium4.3CVSS 3.0

AVNACLPRLUINSUCNILAN

EPSS

1.40%

69.0th percentile

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lunary-ai	lunary-ai_lunary	>= unspecified < 1.4.3	1.4.3
lunary	lunary	>= 1.2.7 < 1.4.3	1.4.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.