CVE-2024-8765
In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.
Attack Parameters
Technical Impact
Affected Configurations
Total: 84 detected entries
Time Line
Key Metrics
Recommended Solution
Related News Articles
1 article(s) mentioning this vulnerability
The Biggest Cybersecurity and Cyberattack Stories of 2025
Discover the biggest cybersecurity stories of 2025, including the rise of new threat groups, data breaches, phishing attacks, and the…
Immediate Action Plan
1. Inventory
Identify all affected systems in your infrastructure.
2. Assessment
Assess exposure and criticality for your organization.
3. Mitigation
Apply patches or available workarounds.
4. Verification
Test and confirm effectiveness of applied measures.