Broken Access Control in Lunary AI Product

CVE-2024-10272

What is CVE-2024-10272?

The Lunary AI product exposes a significant vulnerability that allows unauthorized users to access sensitive datasets. By sending a GET request to the /v1/datasets endpoint, an attacker can retrieve data without needing a valid authorization token, potentially leading to the exposure of confidential information. Immediate remedial action is recommended to mitigate this risk and protect user data.

References