VYPR
← All advisories
Unrated severityNVD Advisory· Published Mar 20, 2025· Updated Oct 15, 2025

Improper Access Control in lunary-ai/lunary

CVE-2024-8999

Description

lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Lunary AI/Lunaryllm-fuzzy2 versions
    <=1.4.25+ 1 more
    • (no CPE)range: <=1.4.25
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.