CVE-2024-1741: lunary — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2024-1741

CVSS 9.1 · Critical EPSS 0,59%

Kerentanan Incorrect Authorization pada lunary. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.

Rincian

Terbit di NVD: 10 April 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,59% peluang dieksploitasi; lebih tinggi dari 46,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lunary	lunary	Semua versi sebelum 1.2.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2 patch
https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b exploit · issue tracking · patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.