Information Disclosure in Lunary AI Versions Affecting User Account Recovery Hashes

CVE-2024-3502

What is CVE-2024-3502?

An information disclosure vulnerability has been identified in Lunary AI's Lunary product, affecting versions up to and including 1.2.5. This vulnerability allows authenticated users to inadvertently expose account recovery hashes when accessing response data from the GET /v1/users/me and GET /v1/users/me/org endpoints. Although these hashes are not directly tied to user passwords, their exposure poses a risk of enabling account recovery attacks or other malicious activities. The issue has been mitigated in version 1.2.6, where the relevant access controls were enhanced to safeguard sensitive information more effectively.

References