# CVE-2024-6867: Lunary information disclosure in runs endpoint

Source: https://junglewise.ai/threats/cve-2024-6867-lunary-information-disclosure-in-runs-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-09-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-6867 · Severity: low · CVSS 3 · Published 2024-09-13

Lunary is an open-source platform for managing AI application runs and analytics. A vulnerability in the runs API endpoint allowed unauthorized users to retrieve information about runs they should not have access to, including private runs and their related runs. This could expose sensitive AI application data and operational details to unauthorized parties.

Technologies: [lunary (npm)](https://junglewise.ai/threats/technologies/lunary). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-6867 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-6867 being exploited in the wild.

**How severe is CVE-2024-6867?** Low severity, with a CVSS score of 3, published 13 September 2024.

**Which products and versions are affected?** lunary (npm) SEMVER:introduced=0,fixed=1.4.10.

**Is there a fix for CVE-2024-6867?** Yes. lunary (npm): upgrade to 1.4.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-6867 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-6867?** Check whether you run lunary (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lunary (npm): upgrade to 1.4.10 or later

  ```sh
  npm install lunary@1.4.10
  ```


## Technical details

An information disclosure vulnerability exists in the lunary runs/{run_id}/related endpoint that fails to validate user access rights before returning run data. The endpoint returns not only the requested run but also all child runs with the specified run_id as their parent, regardless of authorization status. An authenticated attacker with knowledge of any run_id (public or private) can enumerate and retrieve related runs they are not authorized to access. The vulnerability affects all versions prior to 1.4.10, which implements proper access control checks on this endpoint.

## Affected products

- Lunary AI lunary prior to 1.4.10

## Identifiers

- CVE-2024-6867
- GHSA-9jmp-j63g-8x6m

## Timeline

- 2024-09-13: disclosed
- 2024-09-13: patched: Version 1.4.10 addresses the vulnerability with proper access control checks
- 2025-06-20: other: Advisory withdrawn due to package ecosystem mismatch; vulnerability remains valid for the affected component

## References

- [https://github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a162225ca](https://github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a162225ca)

## Related threats

- [Lunary improper access control in invite user functionality](https://junglewise.ai/threats/cve-2024-6087-lunary-improper-access-control-in-invite-user-functionality)
- [Lunary Cross-Site Request Forgery in CORS](https://junglewise.ai/threats/cve-2024-6862-lunary-cross-site-request-forgery-in-cors)
- [Lunary improper authentication in SAML configuration](https://junglewise.ai/threats/cve-2024-6582-lunary-improper-authentication-in-saml-configuration)
- [Lunary-ai Lunary access control bypass in prompt variation management](https://junglewise.ai/threats/lunary-ai-lunary-access-control-bypass-in-prompt-variation-management-cd347a2d)
- [lunary-ai lunary authorization bypass in project access](https://junglewise.ai/threats/cve-2024-4146-lunary-ai-lunary-authorization-bypass-in-project-access)