Unauthorized Dataset Deletion Vulnerability in lunary-ai/lunary

CVE-2024-5130

What is CVE-2024-5130?

A vulnerability in Lunary AI's dataset deletion endpoint allows unauthenticated users to delete any dataset due to insufficient authorization checks. The flaw arises because the system fails to validate if the project ID associated with the dataset belongs to the currently authenticated user. This oversight permits unauthorized deletion of datasets, creating potential risks for data security and integrity. The issue has been rectified in Lunary AI version 1.2.8, ensuring proper authorization checks are in place to secure user data against unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References