CVE-2024-10272: Lunary

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorization by sending a GET request to the /v1/datasets endpoint without a valid authorization token.

Affected products

• Lunary Lunary: before 1.4.9 (fixed in 1.4.9)

Published 2025-03-20. Last modified 2026-06-17.