CVE-2024-3761 is a high severity vulnerability (CVSS 7.5) in Lunary. The DELETE endpoint for datasets lacks authentication and authorization, so anyone can delete a dataset. The record says the issue was fixed in version 1.2.8. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- lunary-ai/lunary version 1.2.2, according to the record.
Severity in the record: High, CVSS 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-862, missing authorization.
Fixed version: The record says the issue was fixed in version 1.2.8.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Check the version you run, from your package lockfile or container tag, and compare with 1.2.8.
- Look at API access logs for DELETE requests to the datasets path from unexpected sources.
You can also paste a dependency manifest into the free in-browser dependency scan to see which known CVEs your libraries carry. That helps for packages such as Pydantic or Qdrant clients, while self-hosted applications are best tracked in an inventory by hand.
What to do now
- Upgrade to the fixed release.
- Put the API behind a gateway or proxy that requires a valid token for every method.
- Keep backups of the data the endpoint can delete.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3761.
Why it matters
Authentication answers who you are. Authorization answers what you may do. A missing authorization check means a request is processed even though nobody asked whether the caller is allowed to make it. Every route that changes or deletes data needs an explicit check on the caller's identity and rights.
The vulnerable route is the datasets endpoint in the backend API. The record says even users without a valid token could delete a dataset. For a platform that holds evaluation datasets for language model apps, that can mean lost work and disrupted service. Upgrading to 1.2.8 or later is the fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Which version fixes it?
The record states 1.2.8. Anything older than that, including the named 1.2.2, should be upgraded.
Is CVE-2024-3761 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
