Insecure Direct Object Reference in Lunary API Affects User Projects
CVE-2025-4962

7.7HIGH

Key Information:

Vendor

Lunary-ai

Status
Lunary-ai/lunary
Vendor
CVE Published:
18 August 2025

What is CVE-2025-4962?

An Insecure Direct Object Reference vulnerability has been discovered in the Lunary API, specifically within the POST /v1/templates endpoint. This issue allows authenticated users to manipulate the projectId query parameter, enabling them to create templates in projects that they do not own due to the lack of necessary server-side validation. Affected versions are up to 0.8.8, and a fix has been implemented in version 1.9.23 to mitigate this security risk.

Affected Version(s)

lunary-ai/lunary < 1.9.23

References

https://huntr.com/bounties/137a0aef-e243-49d4-832f-8e5605...
https://github.com/lunary-ai/lunary/commit/e977d06f18a615...

CVSS V3.0

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-4962 : Insecure Direct Object Reference in Lunary API Affects User Projects