CVE-2025-48757

Published May 30, 2025

Last updated 2 months ago

Lovable

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-48757 describes a vulnerability found in the Lovable software system, specifically concerning an insufficient database Row-Level Security (RLS) policy. This flaw, present in Lovable through April 15, 2025, allows remote and unauthenticated attackers to read from or write to arbitrary database tables of sites generated using the platform. The vulnerability is categorized as an "Incorrect Authorization" issue (CWE-863) and stems from the failure to enforce or maintain secure default RLS configurations for user projects. This can lead to unauthorized access to sensitive data, including Personally Identifiable Information (PII) and API keys, and potentially enable the injection of malicious data or manipulation of existing records.

Description: An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
Source: cve@mitre.org
NVD status: Deferred
CNA Tags: disputed, exclusively-hosted-service

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.3
Impact score: 4.7
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Severity: CRITICAL

Weaknesses

cve@mitre.org: CWE-863

Hype score: Not currently trending

References