PT-2025-12266 · Lunary · Lunary

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-9096

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.4.28

Description The issue allows low-privilege users to modify checklists by sending a PATCH request to the /checklists/:id route due to a lack of proper access control. This enables any user associated with the project to modify checklists, including changing the slug or data fields, which can lead to tampering with essential project workflows, altering business logic, and introducing errors that undermine integrity.

Recommendations For version 1.4.28, consider implementing proper access control middleware to ensure that only authorized users, such as project owners or admins, can modify checklist data. As a temporary workaround, restrict access to the /checklists/:id route to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2024-9096

Affected Products

Lunary

References · 5

• 🔥 https://huntr.com/bounties/653e7109-4c21-4e33-b636-7598d3202b9a · Exploit
• https://github.com/lunary-ai/lunary/commit/a8d7b2959e87c30fbafdb12af7ffa093385dcc60 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9096 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9096 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902968880211038613 · Twitter Post