CVE-2025-48757

Name of the Vulnerable Software and Affected Versions Lovable versions prior to 2025-04-16

Description An insufficient database Row-Level Security (RLS) policy allows remote unauthenticated attackers to read from or write to arbitrary database tables of sites generated by the platform. Row-Level Security is a security feature that restricts which rows of data are returned in a query based on the user's identity. In affected applications, the RLS policy was either missing, misconfigured, or set to USING (true), which effectively leaves the tables open to anyone possessing the public anonymous key.

Real-world impact includes over 170 apps being exposed, with one specific instance resulting in the leak of 18,697 user records. Additionally, 303 insecure endpoints were identified as exposed.

Recommendations For versions prior to 2025-04-16, review and properly configure the Row-Level Security policies in the associated Supabase databases to ensure data isolation and restrict unauthorized access to tables.