Lunary AI Missing Authorization Vulnerability in Evaluators Deletion Endpoint

A vulnerability exists in Lunary AI versions prior to 1.5.9, where the /v1/evaluators/ endpoint allows users to delete evaluators from a project without proper access control. This lack of middleware verification enables low-privilege users to remove evaluator data, leading to permanent data loss and potential disruption of operations, such as breaking a CI pipeline that relies on the deleted evaluator.

Impact

This vulnerability allows low-privilege users to delete evaluator data, causing permanent data loss and potentially disrupting operations that depend on the deleted resources.

Reproduction

To reproduce this vulnerability, log in as a user with 'billing' role, which does not have access to evaluation data. Copy the access token and send a DELETE request to the /v1/evaluators/ endpoint, including the evaluator ID and the authorization token in the request headers.

Remediation

Users can update to Lunary AI version 1.5.9 or later, where this vulnerability has been fixed.