CVE-2024-5129 is a high severity (CVSS 8.2) missing authorization flaw in lunary-ai/lunary version 1.2.2. Any user can delete any dataset by ID because the delete function never checks permissions. The record names no fixed version, so use the latest release.
What's affected
The record lists version 1.2.2 of lunary-ai/lunary. The flaw sits in the datasets.delete function in the datasets index file, which accepts a DELETE request carrying a dataset ID and removes it without asking who the caller is.
The record gives no patched version. The reference is a commit (14078c1) that is also the reference for CVE-2024-5130, where the record states a fix in 1.2.8. That suggests the fix shipped by then, but treat it as an inference and confirm in the release notes.
How to check if you're exposed
Find the version your deployment runs:
docker ps --format '{{.Names}} {{.Image}}' | grep -i lunary
Then look at the project release list for the first tag containing commit 14078c1. If you have a git checkout:
git branch --contains 14078c1d2b8766075bf655f187ece24c7a787776
If your branch is not listed, you do not yet have the change.
What to do now
- Upgrade to a Lunary release that contains commit 14078c1 or later.
- Take a database backup right now so a deleted dataset can be restored.
- Audit who has accounts on the instance and remove unneeded ones.
- Check the application or database logs for DELETE calls on dataset routes you did not expect.
- Add an alert on bulk dataset deletion if your logging stack supports it.
Why it matters
This is CWE-862, a missing authorization check. Authentication tells the server who you are. Authorization decides what you may do. Here the route trusted any caller, so the user's role never entered the decision.
The impact is on integrity and availability rather than on secrecy: evaluation datasets disappear. For teams that rely on those datasets to test prompts before shipping, losing them stalls work and can hide regressions. The record does not set the KEV flag.
Quick check
How is this different from CVE-2024-5130?
Both involve dataset deletion. This one covers any user deleting datasets in 1.2.2, while 5130 describes unauthenticated deletion and a project ID that is not tied to the caller.
Can I recover deleted datasets?
Only from your own backups, as far as the advisories say.
Sources
Last reviewed: 19 October 2026.
