CVE-2026-65013

HighCVSS 8.8

Published: 22/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

44th percentile - higher than 44% of all known CVEs

Summary

Onlook up to version 0.2.32 contains a Broken Object Level Authorization (BOLA) vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values in tRPC API procedures. Attackers can read, modify, and delete other users' projects, members, and conversation history.

Risk Assessment

The organization is at risk of unauthorized access to other users' data, potentially leading to leakage of sensitive information, project manipulation, and data integrity breaches.

Recommendation

Immediately update Onlook to a version containing the fix (commit 423e2e9) or later, which introduces proper authorization validation for tRPC API procedures.

Other vulnerabilities in Onlook

CVE-2025-63784Medium
An Open Redirect vulnerability exists in the OAuth callback handler in onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The application trusts the X-Forwarded-Host header without proper validation when constructing a redirect URL, allowing a remote attacker to redirect an authenticated user to an arbitrary external website.

Original NVD description (English source)

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS