CVE-2026-65013
Received Received - Intake

Broken Object Level Authorization in Onlook

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: VulnCheck

Description
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-65013
EUVD
EUVD-2026-47745

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
onlook-dev onlook to 0.2.32 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65013 is an Insecure Direct Object Reference (IDOR) vulnerability in Onlook through version 0.2.32. It allows authenticated attackers to access, modify, or delete other users' resources by supplying arbitrary UUID values to tRPC API procedures like project.get, member.remove, and chat.conversation.delete without proper authorization validation.

Detection Guidance

To detect this vulnerability, inspect tRPC API endpoints for missing authorization checks. Look for procedures like project.get, member.remove, or chat.conversation.delete that accept arbitrary UUIDs without validation. Check if verifyProjectAccess or similar helpers are implemented across all relevant routers.

Impact Analysis

An attacker could read sensitive project data, remove members from projects, delete conversations, or modify other users' resources. This could lead to data breaches, loss of intellectual property, or disruption of services for affected users.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data without authorization and HIPAA by allowing unauthorized access to protected health information. It undermines data integrity and confidentiality requirements in these regulations.

Mitigation Strategies

Apply the fix from commit 423e2e9 by adding verifyProjectAccess and similar authorization helpers to all tRPC procedures. Ensure these checks validate user ownership before data operations. Consider switching to a non-superuser Postgres role to enforce Row Level Security.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65013. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart