Lunary IDOR Vulnerability in Score Update Endpoint

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Lunary version 1.6.0. This issue arises in the PATCH /v1/runs/:id/score endpoint, where the id parameter can be manipulated to update the score data of any run. The endpoint fails to properly validate whether the authenticated user has the right to modify the specified runId, allowing users with valid accounts to alter other users' run scores by changing the id value in the request URL. This vulnerability was addressed in version 1.6.1.

Impact

Exploitation of this vulnerability allows users to unauthorizedly modify the score data of runs belonging to other users.

Remediation

Users can upgrade to Lunary version 1.6.1 or later to address this vulnerability.