Access Control Flaw in Lunary-AI Product

CVE-2024-9096

What is CVE-2024-9096?

In lunary-ai's lunary version 1.4.28, a significant access control flaw exists in the /checklists/:id route. This vulnerability permits low-privilege users to alter checklists via PATCH requests without proper authorization checks. The absence of access controls allows any user associated with the project to modify critical checklist data, including changing slugs and altering data fields. Such unrestricted access can severely disrupt essential project workflows, compromise business logic, and potentially introduce errors that impact the overall integrity of the project.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References