The vulnerability stems from the absence of authentication and authorization mechanisms on the DELETE endpoint for datasets within the application. As a result, any individual, regardless of their authentication status, could issue a DELETE request to remove a dataset. This flaw exposes all datasets to potential unauthorized deletion, posing a significant risk to data integrity and availability within the application.

An attacker, without needing to authenticate, can exploit this vulnerability by sending a specially crafted DELETE request to the vulnerable endpoint. By setting the environment variable DEFAULT_PLAN to unlimited, gaining UI access, and then creating a dataset, the attacker can subsequently send a DELETE request specifying the ID of the dataset they wish to remove. This action results in the deletion of the dataset without any verification of the requester's identity or permissions.

All users of the lunary-ai/lunary application version 1.2.2 are affected by this vulnerability, as any dataset they create or rely on within the application could be deleted by an unauthorized party.