| Package | Affected versions | Patched versions |
|---|---|---|
| lunary | ≥ 1.2.2, < 1.2.7 | 1.2.7 |
In lunary-ai/lunary versions 1.2.2 through 1.2.6, an incorrect authorization vulnerability allows unprivileged users to re-generate the private key for projects they do not have access to. Specifically, a user with a 'Member' role can issue a request to regenerate the private key of a project without having the necessary permissions or being assigned to that project. This issue was fixed in version 1.2.7.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free