Back to overview

CVE-2026-65013

HIGH
8.8
CVSS 3.1
Description
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

Metadata

CVE ID
CVE-2026-65013
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-07-21 11:32 UTC
Published
2026-07-22 16:14 UTC
Last updated
2026-07-22 16:14 UTC
Primary CWE
CWE-639
Authorization Bypass Through User-Controlled Key
Vendor / Product
onlook / repo
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
onlook repo — 0 ≤ 0.2.32, 423e2e924366419e418ee049093872d535eea41a
Weakness (CWE)
CWESourceDescription
CWE-639 cna Authorization Bypass Through User-Controlled Key
CVSS scores (2)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
8.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (4)
Back to overview