high7.5
CVE-2024-10272
lunary-ai/lunary is vulnerable to broken access control in the latest version.
Impact
lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lunary | Lunary | before 1.4.9 |