Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2024-6867 Details

Description

An information disclosure vulnerability exists in the lunary-ai/lunary, specifically in the `runs/{run_id}/related` endpoint. This endpoint does not verify that the user has the necessary access rights to the run(s) they are accessing. As a result, it returns not only the specified run but also all runs that have the `run_id` listed as their parent run. This issue affects the main branch, commit a761d833. The vulnerability allows unauthorized users to obtain information about non-public runs and their related runs, given the `run_id` of a public or non-public run.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/lunary-ai/lunary/commit/35afd4439464571eb016318cd7b6f85a162225ca	[email protected]	Patch
https://huntr.com/bounties/460df515-164c-4435-954b-0233a181545f	[email protected]	ExploitThird Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-1220	Insufficient Granularity of Access Control	[email protected]

Affected Products

Product	Versions
lunary lunary	1.4.9
CPE cpe:2.3:a:lunary:lunary:1.4.9:::::::* Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Sep 19, 2024	Initial Analysis	[email protected]
Sep 13, 2024	New CVE Received	[email protected]