{"id":"CVE-2024-10330","aliases":["EUVD-2025-7110","GHSA-fqr7-jjqq-hpr6"],"status":"published","title":"Improper Access Control in lunary-ai/lunary","description":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00527,"percentile":0.44942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-862"],"published":"2025-03-20T10:10:28Z","modified":"2026-06-17T06:55:25Z","products":[{"vendor":"lunary","product":"lunary"},{"vendor":"lunary-ai","product":"lunary-ai/lunary"}],"references":[{"url":"https://huntr.com/bounties/598ecd65-1723-4fb7-a9aa-9c4f56a5a2aa","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/lunary-ai/lunary/commit/8ba1b8ba2c2c30b1cec30eb5777c1fda670cbbfc","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10330"},{"url":"https://github.com/advisories/GHSA-fqr7-jjqq-hpr6"}],"sources":{"cve":[{"id":"CVE-2024-10330","title":"Improper Access Control in lunary-ai/lunary","description":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.","status":"published","published":"2025-03-20T10:10:28.504Z","modified":"2025-10-15T12:49:26.472Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:34:02.321514Z"}],"euvd":[{"id":"EUVD-2025-7110","description":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.","status":"published","published":"2025-03-20T10:10:28Z","modified":"2025-10-15T12:49:26Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:32.493073Z"}],"ghsa":[{"id":"GHSA-fqr7-jjqq-hpr6","title":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control,...","description":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.","status":"published","published":"2025-03-20T12:32:39Z","modified":"2025-10-15T15:31:27Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-284","CWE-862"],"updated_at":"2026-11-02T15:03:59.559504Z"}],"nvd":[{"id":"CVE-2024-10330","description":"In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.","status":"published","published":"2025-03-20T10:15:16.23Z","modified":"2026-06-17T06:55:25.483Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:45.815983Z"}]}}