CVE-2024-8765 affects lunary-ai/lunary, specifically version git afc5df4, due to a flaw in its privilege check mechanism. The system mistakenly grants public access to endpoints if their path contains '/auth/', enabling unauthenticated attackers to bypass security. This high-severity vulnerability (CVSS 7.3) allows attackers to access and modify sensitive data and exploit other organizations' resources without authentication. Currently, there is no public exploit code, active exploitation, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.23CPE matchmatch criteria | cpe:2.3:a:lunary:lunary:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.