Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-8765Improper Path Equivalence Resolution in lunary-ai/lunary

High 7.3

In plain English

A high-severity security flaw in lunary-ai/lunary from lunary-ai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.0)7.3High

Exploit odds (30 days)0.8%top 41.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.

Affected products (as reported)

Vendor	Product	Versions
lunary-ai	lunary-ai/lunary	unspecified – before 1.4.23

Weakness: CWE-41 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References