Unauthorized Dataset Deletion Vulnerability in lunary-ai/lunary

CVE-2024-5130

Summary

A vulnerability in Lunary AI's dataset deletion endpoint allows unauthenticated users to delete any dataset due to insufficient authorization checks. The flaw arises because the system fails to validate if the project ID associated with the dataset belongs to the currently authenticated user. This oversight permits unauthorized deletion of datasets, creating potential risks for data security and integrity. The issue has been rectified in Lunary AI version 1.2.8, ensuring proper authorization checks are in place to secure user data against unauthorized access.

References