Description
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lunary-ai | lunary-ai/lunary | unspecified – < 1.4.26 | 1.4.26 |