CVE-2024-10330
MEDIUMlunary < 1.5.7 - Missing Authorization in /v1/evaluators/ Endpoint
Title source: llmDescription
In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/598ecd65-1723-4fb7-a9aa-9c4f56a5a2aa
Scores
CVSS v3
6.5
EPSS
0.0049
EPSS Percentile
38.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (1)
lunary/lunary
< 1.5.7
Published
Mar 20, 2025
Tracked Since
Feb 18, 2026