CVE-2024-7476 — Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates …
Published: 2025-03-20 · CVSS: 4.3 · CVSS 3.0
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7