CVE-2025-4962 IDOR Vulnerability in Template Creation via `projectId` Manipulation in lunary-ai/lunary
Authenticated attackers can create templates in other users' projects by manipulating the projectId parameter due to missing ownership validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-4962?
CVE-2025-4962 is a high-severity missing authorization vulnerability in lunary-ai/lunary, published on 18 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the `projectId` query parameter. The root cause of this issue is the absence of server-side validation to ensure that the authenticated user owns the specified `projectId`. The vulnerability has been addressed in version 1.9.23.
Weakness: CWE-284
Which versions are affected by CVE-2025-4962?
How do I fix CVE-2025-4962?
No fix has been published for CVE-2025-4962 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-4962 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4962 exists.
Sources
Also known as GHSA-jgvw-vmvx-q85m.