CVE-2024-1665

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.0.0

Description The issue concerns unauthorized evaluation creation due to missing server-side checks for user account status during evaluation creation. Although the web UI restricts evaluation creation, the lack of server-side checks allows for potential unauthorized access.

Recommendations For lunary-ai/lunary version 1.0.0, consider implementing server-side checks for user account status during evaluation creation to prevent unauthorized access. As a temporary workaround, restrict evaluation creation to authorized users until a patch is available.