CVE-2025-48757 Missing authorization in Lovable
Remote unauthenticated attackers can read or write arbitrary database tables in Lovable-generated sites due to insufficient Row-Level Security policies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-48757?
CVE-2025-48757 is a critical missing authorization vulnerability in Lovable, published on 30 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
Weakness: CWE-863
Which versions are affected by CVE-2025-48757?
How do I fix CVE-2025-48757?
No fix has been published for CVE-2025-48757 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-48757 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-48757 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-773x-pxjg-gxgx.