Executive brief
Lunary is an open-source platform for managing and monitoring AI/LLM applications. A flaw in its project access controls allows any authenticated user within an organization to access and modify projects they should not have permission to view, potentially exposing sensitive AI models, configurations, and data. An attacker with basic organizational membership can read, create, update, or delete resources in any project.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the checkProjectAccess middleware method. The flaw resides in inadequate permission checks for project access: the code verifies only that a user belongs to the organization owning the project, but fails to validate explicit project-level access rights via the account_project table. This allows any authenticated organization member to access and fully manipulate all projects. The vulnerability affects versions before 1.2.26 and was patched in that version. Attack requires network access and valid organizational credentials, but no special privileges or user interaction.
Affected products
- lunary-ai lunary before 1.2.26
Timeline
- 2024-06-08: disclosed
- 2024-06-10: patched: Version 1.2.26 fixes the vulnerability