CVE-2024-4151 is a high severity improper access control flaw in lunary-ai/lunary version 1.2.2. NVD scores it 8.1. Users can view and update prompts in any project through template version requests. Upgrade to a release with the fix commit and review prompt history.
What's affected
The record lists lunary version 1.2.2. It says users can view and update any prompts in any projects because the handling of PATCH and GET requests for template versions lacks sufficient access control checks. NVD gives the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
The record links a fix commit in the lunary repository and a huntr bounty. We did not fetch either, so confirm the first release with the fix in the project release notes.
Weakness class: CWE-639 (authorization bypass through user-controlled key). The label means a user can supply an identifier, here a template version, and the server does not confirm that the identifier belongs to them.
How to check if you're exposed
If you self host lunary, find the running version:
docker inspect --format "{.Config.Image}" CONTAINER_NAME
Then look at prompt template history in each project for edits you did not expect, especially by users who do not work on that project. Changed prompts can alter application behaviour without any code change.
What to do now
- Upgrade lunary to a release with the fix and confirm it in the notes.
- Review recent prompt template versions in every project and compare them against your records.
- Restore known good prompts where you find unexpected edits.
- Limit accounts to those who need them and remove stale users.
- Treat prompts as code: keep a copy in version control so changes can be compared.
Why it matters
This is an insecure direct object reference. The request names a resource by an identifier, and the server returns or changes it without confirming the caller has rights to it. Anyone who can guess or discover identifiers can read or write across project boundaries.
In an LLM operations tool the stakes include more than reading. A changed prompt changes what a production application says and does, which is an integrity problem that is hard to spot. The KEV flag is false and the record does not claim exploitation in the wild.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory of vulnerability pages for software you already track.
Quick check
What can an attacker change?
Per the record, prompts in any project, through PATCH requests for template versions.
Which release fixes it?
The record links a fix commit but names no release. Check the project release notes.
Sources
These are the references listed in the record. We did not fetch them for this draft, so the version and fix details above come from the record alone and the advisory should be checked.
Last reviewed: 19 October 2026.
