CVE-2025-63783
BaseFortify
Publication date: 2025-11-07
Last updated on: 2026-02-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| onlook | onlook | 0.2.32 |
| onlook | web_application | 0.2.32 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Object Level Authorization (BOLA) issue in the tRPC project mutation APIs of the Onlook web application version 0.2.32. It occurs because the API does not verify whether the authenticated user owns or is a member of the project they are trying to modify. As a result, an attacker who is authenticated can send requests with another user's project ID to unlawfully modify, delete, or manipulate tags on that project.
How can this vulnerability impact me? :
This vulnerability can severely compromise data integrity and availability by allowing an attacker to modify, delete, or manipulate tags on projects they do not own or belong to. This unauthorized access can lead to loss or corruption of project data and disrupt normal application functionality.