CVE-2024-5389

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.

• CWE-1220

• https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2Exploit, Third Party Advisory
• https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2Exploit, Third Party Advisory

Published

Jun 9, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53877NVIDIA CUDA toolkit for all platforms contains a vulnerabili…3.3
• CVE-2024-53878NVIDIA CUDA toolkit for Linux and Windows contains a vulnera…2.8
• CVE-2024-53879NVIDIA CUDA toolkit for Linux and Windows contains a vulnera…2.8
• CVE-2024-5388Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-53880NVIDIA Triton Inference Server contains a vulnerability in t…6.5
• CVE-2024-53881NVIDIA vGPU software contains a vulnerability in the host dr…5.5
• CVE-2024-53899virtualenv before 20.26.6 allows command injection through t…7.8
• CVE-2024-5390A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-53900Mongoose before 8.8.3 can improperly use $where in match, le…9.1
• CVE-2024-53901The Imager package before 1.025 for Perl has a heap-based bu…5.5
• CVE-2024-53907An issue was discovered in Django 5.1 before 5.1.4, 5.0 befo…7.5
• CVE-2024-53908An issue was discovered in Django 5.1 before 5.1.4, 5.0 befo…9.8