CVE-2024-8765

In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.

In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly identifies certain endpoints as public if the path contains '/auth/' anywhere within it. This allows unauthenticated attackers to access sensitive endpoints by including '/auth/' in the path. As a result, attackers can obtain and modify sensitive data and utilize other organizations' resources without proper authentication.

En lunary-ai/lunary, el mecanismo de verificación de privilegios presenta una falla en la versión git afc5df4. El sistema identifica incorrectamente ciertos endpoints como públicos si la ruta contiene "/auth/". Esto permite a atacantes no autenticados acceder a endpoints sensibles al incluir "/auth/" en la ruta. Como resultado, los atacantes pueden obtener y modificar datos sensibles y utilizar los recursos de otras organizaciones sin la debida autenticación.