Lunary Improper Authorization Vulnerability in Checklist Modification

A vulnerability exists in Lunary version 1.4.28, where low-privilege users can modify checklists through the '/checklists/:id' route. This route lacks adequate access control, allowing any user associated with the project to alter checklist data, including slugs and data fields. Such modifications can disrupt essential project workflows, change business logic, and introduce errors that compromise data integrity.

Impact

Exploitation of this vulnerability allows low-privilege users to unauthorizedly change critical checklist information, potentially disrupting key project processes and introducing errors that could undermine overall project integrity.

Reproduction

To reproduce this vulnerability, log in as a user with 'viewer' role and obtain an access token. Then, send a PATCH request to the '/checklists/:id' route, including a modified slug and data that could impact project integrity.

Remediation

Users can update to Lunary version 1.4.30 or later, where this vulnerability has been fixed.