CVE-2024-10330

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version 1.5.6

Description The issue concerns a lack of proper access control in the "/v1/evaluators/" endpoint, allowing any user associated with a project to fetch all evaluator data regardless of their role. This permits low-privilege users to access potentially sensitive evaluation data.

Recommendations For lunary-ai/lunary version 1.5.6, consider restricting access to the "/v1/evaluators/" endpoint to minimize the risk of exploitation, ensuring that only authorized users can fetch evaluator data.