Access Control Flaw in Lunary AI Before Version 1.5.9

CVE-2024-10762

What is CVE-2024-10762?

The Lunary AI platform, prior to version 1.5.9, contains a significant access control vulnerability in the /v1/evaluators/ endpoint. This issue permits users with insufficient privileges to execute DELETE requests, thereby enabling them to remove evaluators from a project without appropriate authorization. The absence of adequate middleware to verify user roles allows this exploitation, leading to potential permanent data loss and disruptions in project operations. It is essential for users and administrators to ensure they upgrade to the latest version to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References