PT-2026-5650 · Lunary Ai · Lunary

Published 2026-02-02 · Updated 2026-02-11 · CVE-2024-4147

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.2.13

Description An insufficient granularity of access control allows users to delete prompts created in other organizations through ID manipulation. The application does not validate the ownership of the prompt before deletion, only checking for deletion permissions without verifying organizational affiliation. This can lead to legitimate users being unable to access removed prompts and cause information inconsistencies.

Recommendations Ensure proper validation of prompt ownership before allowing deletion operations.

Fix

Weakness Enumeration

CWE-1220

Related Identifiers

CVE-2024-4147

Affected Products

Lunary

References · 6

• https://osv.dev/vulnerability/CVE-2024-4147 · Vendor Advisory
• https://huntr.com/bounties/3f051943-71ea-414c-a528-cd8b5d82a7ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-4147 · Security Note
• https://github.com/lunary-ai/lunary/commit/0755dde1afc2a74ec23b55eee03e4416916cf48f · Note
• https://t.me/CVEtracker/43487 · Telegram Post
• https://t.me/cveNotify/151772 · Telegram Post