PT-2024-34590

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary versions up to and including 1.2.2 Description An Incorrect Authorization issue exists, allowing unauthenticated users to delete any dataset due to the lack of proper authorization checks in the dataset deletion endpoint. The...

CVE-2024-5129: Missing Authorization

A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion...