PT-2025-45466 · Onelook · Onlook

Published 2025-11-07 · Updated 2026-02-05 · CVE-2025-63783

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32

Description A Broken Object Level Authorization (BOLA) issue exists in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application. The API does not properly validate if the authenticated user owns or has membership for the provided project ID. An attacker can send a request with another user’s project ID to modify, delete, or manipulate tags, potentially compromising data integrity and availability. The vulnerable API endpoints include mutation APIs such as update, delete, and add/remove tag. The project ID variable is used in requests to these endpoints and is not sufficiently validated.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-63783

Affected Products

Onlook

References · 7

• 🔥 https://blog.soohyun.tech/CVE-2025-63783-IDOR-in-Onlook-27a557175d2e8061a3dbc931da53f095 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63783 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63783 · Vendor Advisory
• https://t.me/cveNotify/151002 · Telegram Post
• https://tossbank.notion.site/IDOR-in-onlook-27a557175d2e8061a3dbc931da53f095 · Note
• https://t.me/cveNotify/142571 · Telegram Post
• https://twitter.com/AnonOzzyDude/status/1988666012573528100 · Twitter Post