CVE-2024-4151: Lunary Auth Bypass Vulnerability

CVE-2024-4151 Overview

CVE-2024-4151 is an Improper Access Control vulnerability [CWE-639] in lunary-ai/lunary version 1.2.2. The flaw resides in the handling of PATCH and GET requests for template versions. Authenticated users can view and update prompts belonging to any project because the endpoints fail to verify that the requesting user owns the target resource. Attackers with low-privilege accounts can read confidential prompts and modify template versions across tenant boundaries. This affects both data integrity and confidentiality within multi-tenant Lunary deployments used for large language model (LLM) operations.

Critical Impact
Authenticated attackers can read and modify prompt template versions in any project, exposing proprietary LLM prompts and enabling tampering with production AI workflows.

Affected Products

Lunary AI lunary version 1.2.2
Deployments exposing the template versions API endpoints
Multi-tenant Lunary instances hosting prompts for multiple projects

Discovery Timeline

2024-05-20 - CVE-2024-4151 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4151

Vulnerability Analysis

The vulnerability is a classic Insecure Direct Object Reference (IDOR) pattern classified under [CWE-639]. Lunary exposes REST endpoints that operate on template version identifiers supplied directly by the client. When a user issues a GET or PATCH request against a template version, the application retrieves and returns or updates the referenced record without validating that the version belongs to a project the caller is authorized to access.

Because the checks depend only on authentication, any user with a valid session token can enumerate template version IDs and interact with them. The impact is cross-tenant: prompts developed by one organization can be read or overwritten by users of another organization sharing the same instance. Prompt tampering can silently alter downstream LLM output, affecting production applications relying on Lunary as a prompt registry.

Root Cause

The root cause is missing object-level authorization. Route handlers for template versions load records by primary key without joining against the caller's project membership. Backend logic assumes that a valid session implies authorization over any object referenced by ID, which breaks tenant isolation.

Attack Vector

Exploitation requires network access to the Lunary API and a low-privilege authenticated account. An attacker enumerates or guesses template version identifiers and issues GET requests to exfiltrate prompt content or PATCH requests to modify prompt bodies, variables, or metadata. No user interaction is required and complexity is low.

The patched code path is documented in the upstream commit ddfd497, which introduces project-scoped authorization checks before serving or updating template versions. Additional context is available in the Huntr bounty report.

Detection Methods for CVE-2024-4151

Indicators of Compromise

Unexpected PATCH requests to /v1/template-versions/{id} originating from user sessions that do not own the referenced project
GET traffic patterns showing sequential or enumerative access to template version identifiers across multiple projects
Prompt template content changes with no corresponding entry in the owning team's change history

Detection Strategies

Correlate application audit logs of template version reads and writes against the requesting user's project membership to surface cross-tenant access
Instrument the Lunary API with request logging that captures user ID, project ID, and target resource ID for every template version handler invocation
Alert on template modifications performed by accounts that have never previously interacted with the target project

Monitoring Recommendations

Ingest Lunary API access logs into a centralized SIEM and normalize user, project, and resource fields for cross-tenant analytics
Baseline normal template version access patterns per user and alert on statistical outliers
Monitor egress volume from Lunary API endpoints to detect bulk enumeration of prompt content

How to Mitigate CVE-2024-4151

Immediate Actions Required

Upgrade lunary-ai/lunary beyond version 1.2.2 to a build that includes commit ddfd497afd017a6946c582a1a806687fdac888bf
Rotate any prompt content that contains embedded secrets, API keys, or sensitive business logic that may have been exposed
Review application audit logs for unauthorized template version reads or modifications since deployment of 1.2.2

Patch Information

The fix is delivered in the GitHub commit ddfd497, which adds project-scoped access control checks to the template version GET and PATCH handlers. Operators running Lunary from source should pull the latest release branch and redeploy. Container-based deployments should update to a tagged image that includes this commit.

Workarounds

Restrict Lunary API access to trusted network segments using a reverse proxy or web application firewall until patching is complete
Temporarily disable multi-tenant use of the affected instance by limiting accounts to a single project scope
Enforce strict session lifetimes and revoke long-lived tokens to reduce the exploitation window

bash

# Update Lunary to a patched release
git fetch origin
git checkout main
git pull origin main
# Verify the fix commit is present
git log --oneline | grep ddfd497
# Rebuild and redeploy
npm install
npm run build
npm run start