CVE-2025-63783
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-02-05

Assigner: MITRE

Description
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for the requested project ID. An authenticated attacker can send a malicious request containing another user's project ID to unlawfully modify, delete, or manipulate tags on that project, which can severely compromise data integrity and availability.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2026-02-05
Generated
2026-06-16
AI Q&A
2025-11-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-63783
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
onlook onlook 0.2.32
onlook web_application 0.2.32
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Broken Object Level Authorization (BOLA) issue in the tRPC project mutation APIs of the Onlook web application version 0.2.32. It occurs because the API does not verify whether the authenticated user owns or is a member of the project they are trying to modify. As a result, an attacker who is authenticated can send requests with another user's project ID to unlawfully modify, delete, or manipulate tags on that project.

Impact Analysis

This vulnerability can severely compromise data integrity and availability by allowing an attacker to modify, delete, or manipulate tags on projects they do not own or belong to. This unauthorized access can lead to loss or corruption of project data and disrupt normal application functionality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-63783. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart