{"id":"CVE-2024-7476","aliases":["EUVD-2025-6950","GHSA-9xvx-2953-c58g"],"status":"published","title":"Broken Access Control in lunary-ai/lunary","description":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0151,"percentile":0.74803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284","CWE-639"],"published":"2025-03-20T10:09:59Z","modified":"2026-06-17T08:20:17Z","products":[{"vendor":"lunary","product":"lunary"},{"vendor":"lunary-ai","product":"lunary-ai/lunary"}],"references":[{"url":"https://huntr.com/bounties/183761f7-d411-4332-af86-2ccfbcc5bd9f","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/lunary-ai/lunary/commit/8f563c77d8614a72980113f530c7a9ec15a5f8d5","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7476"},{"url":"https://github.com/advisories/GHSA-9xvx-2953-c58g"}],"sources":{"cve":[{"id":"CVE-2024-7476","title":"Broken Access Control in lunary-ai/lunary","description":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.","status":"published","published":"2025-03-20T10:09:59.839Z","modified":"2025-10-15T12:49:51.255Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2025-6950","description":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.","status":"published","published":"2025-03-20T10:09:59Z","modified":"2025-10-15T12:49:51Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:32.071816Z"}],"ghsa":[{"id":"GHSA-9xvx-2953-c58g","title":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2....","description":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.","status":"published","published":"2025-03-20T12:32:46Z","modified":"2025-10-15T15:31:30Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-284","CWE-639"],"updated_at":"2026-11-02T15:03:59.559504Z"}],"nvd":[{"id":"CVE-2024-7476","description":"A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.","status":"published","published":"2025-03-20T10:15:36.467Z","modified":"2026-06-17T08:20:17.077Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:10:45.815983Z"}]}}