CVE-2026-65013

Name of the Vulnerable Software and Affected Versions Onlook versions prior to 0.2.32

Description An issue exists where authenticated attackers can access and manipulate resources belonging to other users. This occurs because the tRPC API procedures project.get, member.remove, and chat.conversation.delete do not properly validate authorization when arbitrary UUID values are supplied. By providing unauthorized projectId or conversationId variables, an attacker can read, modify, and delete project data, members, and conversation history.

Recommendations Update to the version containing commit 423e2e9. Restrict the use of the projectId and conversationId variables in the affected tRPC API procedures until the update is applied.