Access Control Flaw in Lunary AI's Deletion Process

CVE-2024-4147

What is CVE-2024-4147?

In Lunary AI version 1.2.13, an access control vulnerability allows users to delete prompts associated with other organizations due to inadequate ownership validation. This security oversight permits users to manipulate IDs to remove prompts not belonging to their project or organization, resulting in unauthorized deletions. Consequently, legitimate users face disruptions in accessing critical prompts, risking data integrity and leading to potential operational inconsistencies.

References