PT-2024-34582 · Lunary Ai · Lunary

Published 2024-06-06 · Updated 2025-10-15 · CVE-2024-5126

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions 1.2.2 through 1.2.24

Description An improper access control issue exists in the versions.patch functionality for updating prompts, allowing unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in a later version.

Recommendations For versions 1.2.2 through 1.2.24, update to version 1.2.25 to resolve the issue. As a temporary workaround, consider restricting access to the versions.patch functionality until the update is applied.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2024-5126

Affected Products

Lunary

References · 6

• 🔥 https://huntr.com/bounties/8e7e1267-ea6c-4789-b9dc-3410dfac6ec6 · Exploit
• https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297 · Patch
• https://osv.dev/vulnerability/CVE-2024-5126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-5126 · Security Note
• https://twitter.com/CVEnew/status/1798781376017387780 · Twitter Post
• https://t.me/cveNotify/138742 · Telegram Post