CVE-2024-7476

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/{id}/versions endpoint. This issue is resolved in version 1.4.3.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-74776.7A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbi CVE-2024-74785.8When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernam CVE-2024-74798.8Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer CVE-2024-74804.4An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with a CVE-2024-74818.8Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamVie CVE-2024-74847.2The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded CVE-2024-74857.2The Traffic Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page' parameter in the 'UserWebStat' AJAX fun CVE-2024-74868.8The MultiPurpose theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.0 via deserialization o CVE-2024-74875.8An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentic CVE-2024-74885.3Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allo CVE-2024-74894.4The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the fo CVE-2024-74909.8Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code executi