Unauthorized Dataset Deletion Vulnerability in lunary version 1.2.2

CVE-2024-5129

What is CVE-2024-5129?

A vulnerability has been identified in Lunary AI's Lunary product version 1.2.2 that facilitates privilege escalation. This issue resides within the dataset deletion feature, where the application inadequately verifies user permissions. As a result, any user can execute a DELETE request to the server without proper authorization, enabling them to erase any dataset by indicating its ID. The vulnerability lies in the datasets.delete function located in the datasets index file, which lacks essential checks for user permissions, potentially compromising data integrity and security.

References