CVE-2024-4147
Insufficient Access Control in Lunary AI Allows Cross-Org Prompt Deletion
Publication date: 2026-02-02
Last updated on: 2026-02-11
Assigner: huntr.dev
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lunary | lunary | to 1.2.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1220 | The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in lunary-ai/lunary version 1.2.13 is due to insufficient granularity of access control. It allows users to delete prompts created by other organizations by manipulating the prompt ID. The application fails to verify if the prompt belongs to the user's organization or project before allowing deletion, only checking if the user has permission to delete prompts in general. This flaw enables unauthorized deletion of prompts not owned by the user’s organization.
How can this vulnerability impact me? :
The vulnerability can lead to legitimate users being unable to access prompts that have been deleted by unauthorized users from other organizations. This causes information inconsistencies and potential disruption of normal operations relying on those prompts. It may result in loss of important data or resources within the affected application.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately restrict user permissions to ensure that deletion operations verify prompt ownership within the user's organization or project. Implement or enforce access control checks that validate prompt ownership before allowing deletion. Additionally, monitor and audit deletion activities to detect unauthorized prompt removals.