CVE-2026-65013: high-severity vulnerability in onlook repo
Onlook tRPC Insecure Direct Object Reference via multiple procedures
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 8.7epss 0.5%
from disclosure to weapon55 days
Published on NVDJul 22
1st PoC+55d
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
onlook · repopublic PoCs found — 2
githubgithub.com/isaca0315/CVE-2026-65013-BOLA-IDOR★ 0cve_referencegithub.com/onlook-dev/onlook/issues/3122unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.