PT-2025-23236 · Lovable · Lovable

Kody Low + 1 · Published 2025-05-30 · Updated 2026-04-20 · CVE-2025-48757

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lovable versions through 2025-04-15

Description An insufficient database Row-Level Security (RLS) policy in Lovable allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. This issue stems from insecure defaults and a lack of RLS validation before deployment. Reports indicate that over 300 insecure endpoints were exposed, potentially impacting over 170 applications. The vulnerability allowed unauthenticated users to manipulate entire database tables in production environments.

Recommendations For versions through 2025-04-15, ensure robust Row-Level Security policies are implemented and thoroughly validated before deploying applications.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-48757

Affected Products

Lovable

References · 33

• 🔥 https://gist.github.com/lhchavez/625ee42a6c408a850d35e50f8e649de9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48757 · Security Note
• https://twitter.com/JFaganel/status/2029884973675671715 · Twitter Post
• https://twitter.com/arekusandr_/status/2039443275115819373 · Twitter Post
• https://x.com/danialasaria/status/1911862269996118272 · Note
• https://docs.lovable.dev/changelog · Note
• https://t.me/latest_high_impact_cve/2496 · Telegram Post
• https://twitter.com/offseq/status/1928277721299198101 · Twitter Post
• https://t.me/cveNotify/132979 · Telegram Post
• https://reddit.com/r/KryptonSecurity/comments/1nf75ob/an%C3%A1lisis_vulnerabilidad_en_editor_cursor_permite · Reddit Post
• https://twitter.com/CVEnew/status/1928283150683119931 · Twitter Post
• https://reddit.com/r/YouShouldKnow/comments/1rsz6ov/yskresearchers_extracted_2702_hardcoded · Reddit Post
• https://t.me/cvenotify/124089 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1932255707531018631 · Twitter Post
• https://twitter.com/cracbot/status/1930218021466841463 · Twitter Post