TI-2024-10321 Aliases CVE-2024-11137 GHSA-73c8-qmph-r39f

IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary

HIGH 72CWE-639Published 2025-03-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the `runId_score` in the database. The endpoint does not sufficiently validate whether the authenticated user has permission to modify the specified runId, enabling an attacker with a valid account to modify other users' runId scores by specifying different id values. This issue was fixed in version 1.6.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00569 47th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed lunary-ai/lunary (lunary-ai): 1.6.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
lunary-ai	lunary-ai/lunary	before 1.6.1	1.6.1	Patch available	CNA

lunary-ai/lunary Vendorlunary-ai Affected before 1.6.1 Fixed in 1.6.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lunary:lunary::::::::	before 1.6.1	Vulnerable	lunary-ai

cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* Versions before 1.6.1 Vulnerable ·lunary-ai

Remediation

Fix · CNA lunary-ai/lunary (lunary-ai) Fixed in 1.6.1

Timeline

2026-10-02 Threatist record created from CVE-2024-11137
2026-10-03 Alias added: GHSA-73c8-qmph-r39f

References

Exploit 1

https://huntr.com/bounties/0a399d86-0105-4f48-a77b-9fa7d7054be8

Patch 1

https://github.com/lunary-ai/lunary/commit/ded72a95c220904a151d27daf3c67e8644e386c6

TI-2024-08445 Improper Authorization in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
TI-2024-06910 SQL Injection in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
TI-2024-03859 Incorrect Authorization in lunary-ai/lunary CVSS 3.1CRITICAL 9.8
TI-2024-06928 Improper Access Control in lunary-ai/lunary CVSS 3.1CRITICAL 9.1
TI-2024-03267 Exposure of Sensitive Information in lunary-ai/lunary CVSS 3.1CRITICAL 9.1
TI-2024-03266 Exposure of Sensitive Information in lunary-ai/lunary CVSS 3.1CRITICAL 9.1

See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences