CVE Feed

    Dashboard / CVE / CVE-2024-11300

    CVE-2024-11300

    In lunary-ai/lunary before version 1.6.3, an improper access control vulnerability exists where a user can access prompt data of another user. This issue affects version 1.6.2 and the main branch. The vulnerability allows unauthorized users to view sensitive prompt data by accessing specific URLs, leading to potential exposure of critical information.

    Published:Mar 20, 2025
    Last Modified:Oct 15, 2025
    EPS:Mar 20, 2025
    EPSS Score:0.00044
    CVSS Score:6.5

    Affected Products

    Vendor
    Lunary
    Product
    Lunary

    Exploits

    https://huntr.com/bounties/8dca7994-0d92-491e-a419-02adfe23ffa4https://huntr.com/bounties/8dca7994-0d92-491e-a419-02adfe23ffa4

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-10272 (CVSS 7.5) — lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the conten…
    CVE-2024-8998 (CVSS 7.5) — A Regular Expression Denial of Service (ReDoS) vulnerability exists in lunary-ai/lunary version git f07a845. T…
    CVE-2025-0281 (CVSS 5.4) — A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An at…
    CVE-2024-9099 (CVSS 8.1) — In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys f…
    CVE-2024-8765 (CVSS 7.3) — In lunary-ai/lunary, the privilege check mechanism is flawed in version git afc5df4. The system incorrectly id…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High