VulnSocial

CVE-2026-65013Patch

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-23: 1Patch / Workaround · 2026-07-23: 1Technical Details · 2026-07-23: 107-23
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - Onlook Broken Object Level Authorization via tRPC Procedures (CVE-2026-65013) Onlook (through 0.2.32), the open-source AI visual editor for React apps, exposes tRPC API procedures - including project.get, member.remove, and chat.conversation.delete - that accept arbitrary UUID values without checking that the caller owns the referenced object. An authenticated attacker can supply arbitrary projectId or conversationId values to read, modify, and delete other users' project data, members, and conversation history - a cross-tenant IDOR affecting multiple procedures. CVSS 8.7. 👉Update Onlook to the release containing fix commit 423e2e9 (PR #3129).

    Post summary

    CVE-2026-65013 allows authenticated users to perform cross‑tenant IDOR on Onlook's tRPC API by supplying arbitrary UUIDs, and is fixed in the 0.2.32+ release with commit 423e2e9.

    0000076
    254 followersView on X

Explore more

Back to dashboard