CVE-2024-8999

Name of the Vulnerable Software and Affected Versions lunary-ai/lunary version v1.4.25

Description The issue is an improper access control vulnerability in the "POST /api/v1/data-warehouse/bigquery" endpoint. This allows any user to export the entire database data by creating a stream to Google BigQuery without proper authentication or authorization.

Recommendations For lunary-ai/lunary version v1.4.25, update to version 1.4.26 to resolve the issue. As a temporary workaround, consider restricting access to the "POST /api/v1/data-warehouse/bigquery" endpoint until the update is applied.