VULNERABILITY INTELLIGENCE

CVE-2024-7474

CVSS score8.1 HIGH
EPSS probability0.56%
CISA KEVNot currently listed
Published2024-10-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external users by manipulating the 'id' parameter in the request URL. The application does not perform adequate checks on the 'id' parameter, allowing unauthorized access to external user data.

Weakness classification

  • security@huntr.dev: CWE-639
  • nvd@nist.gov: CWE-639

Primary references