| Package | Affected versions | Patched versions |
|---|---|---|
| lunary | < 1.4.26 | 1.4.26 |
lunary-ai/lunary version v1.4.25 contains an improper access control vulnerability in the POST /api/v1/data-warehouse/bigquery endpoint. This vulnerability allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization. The issue is fixed in version 1.4.26.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free