Insufficient Granularity of Access Control Vulnerability Affects Dataset Information Integrity

CVE-2024-5389

What is CVE-2024-5389?

In version 1.2.13 of Lunary, a vulnerability related to insufficient granularity of access control allows users to create, update, get, and delete prompt variations for datasets they do not own. This flaw occurs because the application fails to validate dataset prompt ownership appropriately against the requesting user's organization or project. Consequently, unauthorized modifications can take place, leading to changes in dataset prompts that lack proper authorization. These alterations compromise the integrity and consistency of dataset information, which can adversely impact the outcomes of various experiments.

References