High severity7.5NVD Advisory· Published Jun 6, 2024· Updated Jun 17, 2026
CVE-2024-5130
CVE-2024-5130
Description
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
2- github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776nvdPatch
- huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fenvdExploitIssue TrackingPatchThird Party Advisory
News mentions
0No linked articles in our index yet.