CVE-2024-10330: Lunary

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluator data regardless of their role. This vulnerability permits low-privilege users to access potentially sensitive evaluation data.

Affected products

• Lunary Lunary: before 1.5.7 (fixed in 1.5.7)

Published 2025-03-20. Last modified 2026-06-17.