Broken Access Control in Lunary AI Product by Lunary

CVE-2024-7476

What is CVE-2024-7476?

A vulnerability in Lunary AI's product allows an authenticated attacker to gain unauthorized access and modify user templates. By exploiting a flaw in the access control mechanism, attackers can send a specially crafted HTTP POST request to the /v1/templates/{id}/versions endpoint, potentially compromising user data. This issue has been addressed in version 1.4.3, so users are encouraged to update to the latest release to mitigate any potential risks.

References