Skip to content
Threat Feed
Subscribe

Product

Onlook (<= 0.2.32)

1 brief RSS
high advisory

CVE-2026-65013: Onlook Broken Object Level Authorization Vulnerability

An authorization bypass vulnerability, CVE-2026-65013, exists in Onlook through version 0.2.32, allowing authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures such as project.get, member.remove, and chat.conversation.delete without proper authorization, leading to unauthorized data exposure, modification, or deletion.

Onlook authorization-bypass api-abuse cve
3t 1c