CVE-2024-3760 is a high severity vulnerability (CVSS 7.5) in Lunary. The forgot password page has no rate limit, so an attacker can flood an inbox with reset emails. The record links a fix commit and a huntr report but does not name the release that contains it.
What's affected
- lunary-ai/lunary version 1.2.7, according to the record.
Severity in the record: High, CVSS 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-770, allocation of resources without limits or throttling.
Fixed version: The record links a fix commit and a huntr report but does not name the release that contains it. Check the Lunary releases for the version that includes the commit.
Source conflict: The NVD record was published on 2024-11-14 with CVSS 7.5 (High). The record text names only version 1.2.7 as affected, while a reset flood is an availability and nuisance issue, so a High rating may seem generous. Read the advisory and judge it against your own exposure.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Check your Lunary deployment version in the admin interface or your container image tag.
- Look at your outbound mail logs for bursts of password reset messages.
You can also paste a dependency manifest into the free in-browser dependency scan to see which known CVEs your libraries carry. That helps for packages such as Pydantic or Qdrant clients, while self-hosted applications are best tracked in an inventory by hand.
What to do now
- Upgrade to the release that adds the limit, once you have confirmed which one that is.
- Add rate limiting at your reverse proxy or API gateway for the reset endpoint.
- Watch your mail logs for bursts of reset messages to a single address.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3760.
Why it matters
When a feature costs the server something and nothing limits how often it can be called, a script can turn it into a flood. A password reset page is a common case, because every request sends a real email. Rate limits per account and per source address, plus a cooldown between messages, keep the feature usable without making it a weapon.
The record notes two harms. The victim cannot find real mail in the flood, and the mail servers take on load that can degrade service for the whole organization. This is not data theft, but it can bury a real security email and it costs you sender reputation. A cooldown per account closes most of it.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this a data breach?
No. The record describes email bombing and resource consumption, not disclosure of data.
Is CVE-2024-3760 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
