CVSS 3.0
7.3 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LCVE-2024-8765
High (7.3) in lunary lunary. EPSS 0.8% chance of exploitation in the next 30 days.
In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
- CWE
- CWE-41
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lunary:lunary