PT-2026-63438 · Onelook · Repo

George Chen · CVE-2026-65013 · Publicado 2026-07-22 · Atualizado 2026-07-22

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2026-65013

Produtos afetados

Repo

Referências · 5

• 🔥 https://github.com/onlook-dev/onlook/issues/3122 · Exploit
• https://github.com/onlook-dev/onlook/pull/3129 · Nota
• https://github.com/onlook-dev/onlook/commit/423e2e924366419e418ee049093872d535eea41a · Correção
• https://vulncheck.com/advisories/onlook-trpc-insecure-direct-object-reference-via-multiple-procedures · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-65013 · Nota de Segurança