lunary-ai/lunary version 0.3.0 is vulnerable to unauthorized project creation due to insufficient server-side validation of user account types during project creation. In the free account tier, users are limited to creating only two projects. However, this restriction is enforced only in the web UI and not on the server side, allowing users to bypass the limitation and create an unlimited number of projects without upgrading their account or incurring additional charges. This vulnerability is due to the lack of checks in the project creation endpoint.

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-1599
• lunary-ai/lunary@48d66a3
• https://huntr.com/bounties/f1f9e9d6-de5f-48c4-b4f4-fbd192370417