CVE Feed

    Dashboard / CVE / CVE-2025-4962

    CVE-2025-4962

    An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the `projectId` query parameter. The root cause of this issue is the absence of server-side validation to ensure that the authenticated user owns the specified `projectId`. The vulnerability has been addressed in version 1.9.23.

    Published:Aug 18, 2025
    Last Modified:Apr 15, 2026
    EPS:Aug 18, 2025
    EPSS Score:0.00029
    CVSS Score:7.7

    Affected Products

    Vendor
    Lunary-ai
    Product
    Lunary

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2024-5386 (CVSS 8.8) — In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token lea…
    CVE-2024-4147 (CVSS 6.5) — In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users t…
    CVE-2025-9803 (CVSS 8.8) — lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Goo…
    CVE-2025-5352 (CVSS 9.6) — A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/luna…
    CVE-2025-4779 (CVSS 6.1) — lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthentica…
    CVE-2024-7472 (CVSS 6.5) — lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/use…
    CVE-2024-7473 (CVSS 6.5) — An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary…
    CVE-2024-7474 (CVSS 8.1) — In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user …
    CVE-2024-5130 (CVSS 7.5) — An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which …
    CVE-2024-5131 (CVSS 6.5) — An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to a…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High