What is the severity of CVE-2024-1666?

CVE-2024-1666 is categorized as a medium severity vulnerability due to its potential impact on unauthorized radar creation.

How do I fix CVE-2024-1666?

To fix CVE-2024-1666, implement server-side checks to verify user account status during the radar creation process.

Which versions of Lunary are affected by CVE-2024-1666?

CVE-2024-1666 affects Lunary versions up to but not including 1.2.7.

What does CVE-2024-1666 exploit?

CVE-2024-1666 exploits an authorization flaw that lacks server-side validations in the radar creation workflow.

Is CVE-2024-1666 applicable to all Lunary users?

CVE-2024-1666 primarily affects users with free accounts due to inadequate checks during radar creation.

Vulnerability/
CVE-2024-1666

high

7.5

CWE

770

16/4/2024

10/1/2025

CVE-2024-1666: Unauthorized Radar Creation in lunary-ai/lunary

First published: Tue Apr 16 2024(Updated: )

In lunary-ai/lunary version 1.0.0, an authorization flaw exists that allows unauthorized radar creation. The vulnerability stems from the lack of server-side checks to verify if a user is on a free account during the radar creation process, which is only enforced in the web UI. As a result, attackers can bypass the intended account upgrade requirement by directly sending crafted requests to the server, enabling the creation of an unlimited number of radars without payment.

Credit: security@huntr.dev

Affected Software	Affected Version	How to fix
lunary lunary	<1.2.7

Remedy

https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54

Remedy

https://huntr.com/bounties/0f310501-b5b0-4be0-ae38-d6b836f71ff0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2024-1666?
CVE-2024-1666 is categorized as a medium severity vulnerability due to its potential impact on unauthorized radar creation.
How do I fix CVE-2024-1666?
To fix CVE-2024-1666, implement server-side checks to verify user account status during the radar creation process.
Which versions of Lunary are affected by CVE-2024-1666?
CVE-2024-1666 affects Lunary versions up to but not including 1.2.7.
What does CVE-2024-1666 exploit?
CVE-2024-1666 exploits an authorization flaw that lacks server-side validations in the radar creation workflow.
Is CVE-2024-1666 applicable to all Lunary users?
CVE-2024-1666 primarily affects users with free accounts due to inadequate checks during radar creation.

agent/title
agent/weakness
agent/references
agent/type
agent/description
agent/first-publish-date
agent/author
agent/event
collector/mitre-cve
source/MITRE
agent/severity
agent/remedy
agent/last-modified-date
agent/softwarecombine
agent/source
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/lunary
canonical/lunary lunary

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.