Improper Privilege Management in Lunary AI by Lunary

CVE-2024-10273

What is CVE-2024-10273?

In Lunary AI version 1.5.0, an improper management of privileges allows users with viewer roles to manipulate models that they do not own. The PATCH endpoint does not implement sufficient checks, permitting low-privilege users to modify critical resources, which can compromise the integrity and reliability of the system. This issue necessitates prompt attention to ensure secure access controls and to protect against unauthorized modifications.

References