CVE-2024-9096: Lunary Auth Bypass Vulnerability

CVE-2024-9096 Overview

CVE-2024-9096 is a missing authorization vulnerability [CWE-862] in lunary-ai/lunary version 1.4.28. The /checklists/:id PATCH route lacks middleware that restricts modifications to authorized roles such as project owners or administrators. Any user associated with a project can send a PATCH request and alter checklist fields, including the slug and data attributes.

The flaw enables low-privilege project members to tamper with checklists that drive business workflows. Attackers can corrupt project logic, introduce errors, and undermine data integrity across the Lunary platform.

Critical Impact
Low-privilege users can modify checklist data through an unauthenticated PATCH request, altering business logic and workflow integrity in Lunary deployments.

Affected Products

lunary-ai/lunary version 1.4.28
CPE: cpe:2.3:a:lunary:lunary:1.4.28:*:*:*:*:*:*:*
Component: lunary:lunary

Discovery Timeline

2025-03-20 - CVE-2024-9096 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9096

Vulnerability Analysis

The vulnerability resides in the PATCH handler for the /checklists/:id route in Lunary 1.4.28. The route accepts modification requests without verifying whether the caller holds a privileged role in the target project. As a result, the server processes updates from any authenticated user tied to the project.

Because checklists in Lunary can define operational rules and evaluation criteria, tampering directly influences downstream project behavior. An attacker with basic membership can rewrite the slug to break references or change the data payload to redirect logic. The issue is classified under CWE-862: Missing Authorization.

Root Cause

The root cause is the absence of role-based access control middleware on the PATCH endpoint. The application authenticates the requester but does not authorize the action against the project role model. Authorization checks that exist for other administrative routes were not applied here.

Attack Vector

Exploitation requires network access and a valid low-privilege account on the Lunary instance. The attacker issues a PATCH request to /checklists/:id with a modified JSON body targeting the slug or data fields. No user interaction is required, and the request succeeds regardless of the account's project role.

A verified proof-of-concept is not publicly available. See the Huntr bounty report for additional technical details on the endpoint behavior.

Detection Methods for CVE-2024-9096

Indicators of Compromise

Unexpected PATCH requests to /checklists/:id originating from non-admin accounts.
Audit log entries showing slug or data field changes on checklists made by users without owner or admin roles.
Downstream workflow failures or business logic errors correlated to recent checklist modifications.

Detection Strategies

Enable application-level audit logging on all checklist modification events and capture the requesting user identity and role.
Compare checklist state snapshots against a known-good baseline to identify unauthorized field changes.
Alert on PATCH request volume anomalies against /checklists/:id from accounts that historically only perform read operations.

Monitoring Recommendations

Forward Lunary application and web server logs to a centralized SIEM for correlation with identity events.
Track HTTP method distribution per user account and flag first-time PATCH callers to sensitive routes.
Review commits and configuration changes referencing the fix commit a8d7b29 to confirm deployment status.

How to Mitigate CVE-2024-9096

Immediate Actions Required

Upgrade Lunary beyond version 1.4.28 to a release containing the fix from commit a8d7b29.
Audit existing checklists for unauthorized changes to slug and data fields and restore known-good values where needed.
Review project membership and remove accounts that no longer require access to Lunary projects.

Patch Information

The upstream fix is available in the lunary-ai/lunary repository. The remediation commit a8d7b2959e87c30fbafdb12af7ffa093385dcc60 adds authorization middleware to the checklist modification route. Refer to the GitHub commit details for the exact code changes.

Workarounds

Restrict network access to the Lunary API using a reverse proxy that enforces role-based rules on PATCH requests to /checklists/:id.
Temporarily limit project membership to trusted administrative accounts until the patch is applied.
Implement a web application firewall rule that blocks PATCH requests to checklist endpoints from non-admin session tokens.

bash

# Example reverse proxy rule (nginx) restricting PATCH on checklists to admin API tokens
location ~ ^/checklists/[^/]+$ {
    if ($request_method = PATCH) {
        # Require an admin token header; block otherwise
        if ($http_x_admin_token != "REPLACE_WITH_ADMIN_TOKEN") {
            return 403;
        }
    }
    proxy_pass http://lunary_backend;
}