BaseFortify

Publication date: 2025-11-07

Last updated on: 2026-02-05

Assigner: MITRE

Description

A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for the requested project ID. An authenticated attacker can send a malicious request containing another user's project ID to unlawfully modify, delete, or manipulate tags on that project, which can severely compromise data integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2026-02-05

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63783

Affected Vendors & Products

Vendor	Product	Version / Range
onlook	onlook	0.2.32
onlook	web_application	0.2.32

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is a Broken Object Level Authorization (BOLA) issue in the tRPC project mutation APIs of the Onlook web application version 0.2.32. It occurs because the API does not verify whether the authenticated user owns or is a member of the project they are trying to modify. As a result, an attacker who is authenticated can send requests with another user's project ID to unlawfully modify, delete, or manipulate tags on that project.

Impact Analysis

This vulnerability can severely compromise data integrity and availability by allowing an attacker to modify, delete, or manipulate tags on projects they do not own or belong to. This unauthorized access can lead to loss or corruption of project data and disrupt normal application functionality.

Hi! I’m here to help you understand CVE-2025-63783. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70