PT-2025-33652 · Lunary · Lunary

Published 2025-08-18 · Updated 2025-08-18 · CVE-2025-4962

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Lunary versions up to 0.8.8

Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the POST /v1/templates endpoint of the Lunary API. The vulnerability allows authenticated users to create templates in another user's project by manipulating the projectId parameter. The issue stems from a lack of server-side validation to confirm the authenticated user's ownership of the specified projectId.

Recommendations: Lunary versions prior to 1.9.23: Update to version 1.9.23 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-4962

Affected Products

Lunary

References · 7

• https://osv.dev/vulnerability/CVE-2025-4962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4962 · Security Note
• https://github.com/lunary-ai/lunary/commit/e977d06f18a615963ffbe07e5bdff70218c29907 · Note
• https://t.me/CVEtracker/30279 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1957452097533747244 · Twitter Post
• https://twitter.com/CVEnew/status/1957446821761950150 · Twitter Post
• https://huntr.com/bounties/137a0aef-e243-49d4-832f-8e56056cba1a · Note