GHSA-9JMP-J63G-8X6M Withdrawn Advisory: Lunary information disclosure vulnerability

Withdrawn Advisory This advisory has been withdrawn because the lunary npm package is connected to https://github.com/lunary-ai/lunary-js, not the https://github.com/lunary-ai/lunary repo that is discussed in this advisory. The underlying vulnerability report is still valid, but it doesn't affect...

CVE-2024-6867: Insufficient Granularity of Access Control

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the runs/runid/related endpoint. This endpoint does not verify that the user has the necessary access rights to the runs they are accessing. As a result, it returns not only the specified run but also all runs...