CVE-2024-5130
highpriority · track · 30OT risk · elevatedEPSS 0.005 · 41 %ileEUUSEPSS · scored 2026-10-26
An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (8)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-5130/cnnvd
- https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776cnnvd
- https://github.com/lunary-ai/lunary/releases/tag/v1.2.29Patchcnnvd
- https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fecnnvd
- https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776enisa_euvd
- https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16feenisa_euvd
- https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776Patchnvd
- https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16feExploitIssue TrackingPatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan