CVE-2024-9096: Missing Authorization

In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request. The route lacks proper access control, such as middleware to ensure that only authorized users e.g., project owners or admins can modify checklist data. This...

PT-2025-12266

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.4.28 Description The issue allows low-privilege users to modify checklists by sending a PATCH request to the /checklists/:id route due to a lack of proper access control. This enables any user associated with the...