lunary-ai lunary Broken Access Control Vulnerability

A broken access control vulnerability has been identified in lunary-ai/lunary, allowing unauthorized users to access the content of any dataset. This issue arises because the application does not properly validate authorization tokens before granting access to dataset information. Exploitation can be achieved by sending a GET request to the /v1/datasets endpoint without a valid authorization token.

Impact

Exploitation of this vulnerability allows unauthorized users to view the contents of any dataset, including sensitive information such as messages and dataset details, without proper authorization.

Reproduction

To reproduce this vulnerability, send a GET request to the /v1/datasets endpoint without an authorization token. The response will include the content of the dataset, demonstrating that access control is not properly enforced.

Remediation

Users are advised to update to version 1.4.9 or later, where this vulnerability has been fixed.