CVE-2024-1626 is a high severity (CVSS 8.1) insecure direct object reference in lunary-ai/lunary 0.3.0. The project update endpoint lets an authenticated user change the name of any project by supplying its ID, because it never checks that the project belongs to them. Update to a build that includes the fix commit.
What's affected
The record lists lunary-ai/lunary version 0.3.0 and describes the flaw in the PATCH handler for the projects endpoint. The references are a GitHub fix commit and a huntr bounty report. The record does not name a fixed release, so confirm the version in the Lunary release notes or by checking that the commit is in your build.
The score is 8.1 (high) and the weakness is CWE-639 (authorization bypass through user-controlled key).
How to check if you're exposed
If you self host Lunary, check the version you deployed.
# from your deployment directory
git log -1 --format=%H
git merge-base --is-ancestor 9eb9e526edff8bf82ae032f7a04867c8d58572bc HEAD && echo fixed
If you run a container image, check the image tag against the release notes. Hosted users should check with the vendor. Also review the audit trail for unexpected project name changes.
What to do now
- Upgrade Lunary to a release that contains the fix commit.
- Review project names for unexpected changes.
- Limit signups on self hosted instances to people you trust until you are patched.
- Add an authorization test for every endpoint that takes an object ID.
- Track the Lunary release notes for the next fix.
Why it matters
An IDOR happens when an application trusts an identifier from the request and does not ask whether the caller may touch that object. The cure is an ownership check on the server for every ID.
The weakness here, CWE-639 (authorization bypass through user-controlled key), is one of the most common in multi tenant software. Changing a project name looks minor, but the same missing check often exists on nearby routes, which is why several Lunary CVEs in this period share the pattern. Not listed as exploited. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Does the attacker need an account?
Yes. The record says authenticated users can modify any project name. It does not say an anonymous visitor can.
Sources
Last reviewed: 19 October 2026.
