CVE-2024-11137: Lunary IDOR Auth Bypass Vulnerability

CVE-2024-11137 Overview

CVE-2024-11137 is an Insecure Direct Object Reference (IDOR) vulnerability in lunary-ai/lunary version 1.6.0. The flaw resides in the PATCH /v1/runs/:id/score endpoint, which fails to verify that the authenticated user owns the runId supplied in the URL. An attacker with a valid account can manipulate the id parameter to overwrite score data belonging to other users' runs. The issue was resolved in version 1.6.1. Lunary is an observability and analytics platform for large language model (LLM) applications, so tampering with run scores can corrupt evaluation data used for model quality decisions.

Critical Impact
Any authenticated user can modify score data on arbitrary runs owned by other tenants, undermining the integrity of LLM evaluation and observability data.

Affected Products

lunary-ai/lunary version 1.6.0
Earlier versions of lunary-ai/lunary exposing the PATCH /v1/runs/:id/score endpoint
Fixed in lunary-ai/lunary version 1.6.1

Discovery Timeline

2025-03-20 - CVE-2024-11137 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11137

Vulnerability Analysis

The vulnerability is classified as [CWE-639] Authorization Bypass Through User-Controlled Key. The PATCH /v1/runs/:id/score endpoint accepts a run identifier directly from the request URL and applies the score update against the database record matching that identifier. Authentication is enforced, but per-object authorization is not. As a result, the server treats any authenticated session as sufficient to update any runId_score record. This breaks the tenant isolation model expected of a multi-user analytics service.

Root Cause

The endpoint handler does not correlate the id path parameter with the authenticated user's organization or project before executing the update. Missing an ownership check on the target runId allows lateral access across accounts. This is a common access control failure pattern in REST APIs that rely on opaque identifiers as an implicit authorization boundary.

Attack Vector

An attacker registers or uses an existing Lunary account, obtains a valid session token, and issues a PATCH request to /v1/runs/:id/score with a runId belonging to another tenant. The request succeeds and overwrites the target run's score. Exploitation requires only network access to the Lunary API and does not require user interaction. Attackers who enumerate or guess runId values can systematically corrupt scoring data across the platform.

The vulnerability is described in the Huntr Bounty Report and remediated in the upstream GitHub Commit Changes.

Detection Methods for CVE-2024-11137

Indicators of Compromise

Unexpected PATCH /v1/runs/:id/score requests where the id does not match runs created by the authenticated user's account or project.
Sudden or unexplained changes to runId_score values in the Lunary database that do not correlate with legitimate evaluation activity.
API access logs showing a single account issuing score updates against a large or sequential range of runId values.

Detection Strategies

Review application access logs and correlate the authenticated principal with the owner of each targeted runId. Any mismatch indicates exploitation.
Enable database-level audit logging on the score column and alert on updates that bypass the application's normal ownership checks.
Baseline typical score update volume per user and alert on statistical outliers indicative of enumeration.

Monitoring Recommendations

Forward Lunary API access logs to a centralized logging or SIEM platform for retention and correlation.
Monitor for HTTP 200 responses to PATCH /v1/runs/:id/score requests originating from low-reputation or newly created accounts.
Track integrity of LLM evaluation scoring data with periodic snapshots to detect unauthorized modification post-incident.

How to Mitigate CVE-2024-11137

Immediate Actions Required

Upgrade lunary-ai/lunary to version 1.6.1 or later, which contains the ownership check for the score endpoint.
Audit historical PATCH /v1/runs/:id/score requests to identify any unauthorized score modifications during the exposure window.
Rotate API tokens and review account activity if evidence of exploitation is found.

Patch Information

The fix is committed in the upstream repository as GitHub Commit ded72a9 and shipped in lunary-ai/lunary 1.6.1. The patch adds an authorization check that validates the requesting user's ownership of the target runId before permitting the score update.

Workarounds

If upgrading is not immediately possible, restrict network access to the Lunary API to trusted users only through an authenticating reverse proxy or VPN.
Deploy a reverse proxy rule or Web Application Firewall (WAF) policy that blocks external PATCH requests to /v1/runs/:id/score until the upgrade is applied.
Rotate credentials for any shared or service accounts that had access to the vulnerable endpoint.

bash

# Upgrade lunary-ai/lunary to the patched release
npm install lunary@1.6.1
# or, if using the container image, pull the fixed tag
docker pull lunary/lunary:1.6.1