VYPR
← All advisories
High severity7.5NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-8999

CVE-2024-8999

Description

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Lunary/Lunary
    cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:*
    Range: <1.4.26
  • Lunary AI/Lunaryllm-fuzzy2 versions
    <=1.4.25+ 1 more
    • (no CPE)range: <=1.4.25
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.