CVE-2024-11137 IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary

High 7.5 Published 20 Mar 2025 Updated 15 Oct 2025

An attacker with a valid account can modify other users' run scores by manipulating the ID parameter in the API request.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-11137?

CVE-2024-11137 is a high-severity missing authorization vulnerability in Lunary Lunary, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerability allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the `runId_score` in the database. The endpoint does not sufficiently validate whether the authenticated user has permission to modify the specified runId, enabling an attacker with a valid account to modify other users' runId scores by specifying different id values. This issue was fixed in version 1.6.1.

Weakness: CWE-639

Which versions are affected by CVE-2024-11137?

It affects 1 product.

Products include Lunary Lunary.

How do I fix CVE-2024-11137?

No fix has been published for CVE-2024-11137 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-11137 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-11137 exists.

All Lunary Lunary vulnerabilities

Sources

Also known as GHSA-73c8-qmph-r39f.