CVE-2024-8765

Published: Mar 20, 2025Modified: Jun 17, 2026

7.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: security@huntr.dev (Secondary)

Description

In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.

Affected (1)

Products: Lunary: Lunary

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lunary Lunary	Before 1.4.23

Related CWEs

Improper Resolution of Path Equivalence

The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

References (2)

https://github.com/lunary-ai/lunary/commit/7ff89b0304d191534b924cf063f3648206d497fa

Source: security@huntr.dev

Patch

https://huntr.com/bounties/4908cfcf-607a-412a-9635-966cbb08bb49

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.