Improper access control in lunary-ai/lunary evaluators (CVE-2024-10330)
Date: 2024
Affected: lunary-ai/lunary 1.5.6
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium

In lunary-ai/lunary 1.5.6 the /v1/evaluators/ endpoint lacks proper access control, letting any project user fetch all evaluator data regardless of role.


Mitigations:

Architectural layers (MAESTRO):