Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: lunary-ai/lunary 1.4.30 Clear all filters
TI-2024-08446 CVE-2024-9096 · GHSA-r9m5-fcw8-68f6

Improper Authorization in lunary-ai/lunary

Priority MEDIUM 64

In lunary-ai/lunary version 1.4.28, the /checklists/:id route allows low-privilege users to modify checklists by sending a PATCH request.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.0052 Published 2025-03-20 Fixed in 1.4.30 CWE-862
TI-2024-08448 CVE-2024-9098 · GHSA-fxpx-7wrq-8ggp

Privilege Escalation in lunary-ai/lunary

Priority MEDIUM 62

In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00568 Published 2025-03-20 Fixed in 1.4.30 CWE-863
TI-2024-08445 CVE-2024-9095 · GHSA-j4mc-gwfc-jcf5

Improper Authorization in lunary-ai/lunary

Priority HIGH 82

In lunary-ai/lunary version v1.4.28, the /bigquery API route lacks proper access control, allowing any logged-in user to create a Datastream to Google BigQuery and export the entire database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00734 Published 2025-03-20 Fixed in 1.4.30 CWE-862