An authenticated Firebase Studio user could download another tenant's source code
On June 24, 2026, Google Cloud bulletin GCP-2026-043 said Firebase Studio's GetSignedGcsUrl call let an authenticated user list other tenants' buckets and download their deployment source code. The fix was already deployed. CVE-2026-12715, published July 17, 2026, says the bug was patched on April 15, 2026, rates it High with CVSS 4.0 score 8.5, and says no customer action is needed.
What was reported
Google Cloud bulletin GCP-2026-043, published June 24, 2026, says a vulnerability in Firebase Studio let an authenticated user call GetSignedGcsUrl, list buckets, and download the deployment source code of other tenants. The bulletin rates it High and names CVE-2026-12715. It says no action is required to mitigate the issue because the fix is already deployed on the backend service. As a precaution, it says users who stored sensitive information in a Firebase Studio workspace, such as API keys and the example it gives, GEMINI_API_KEY, may rotate those keys.
CVE-2026-12715, published July 17, 2026, describes the same bug. It says missing authorization in Google Cloud Firebase Studio versions prior to April 15, 2026 let an attacker download other users' deployed source code and access sensitive data through unauthorized GCS URL signing requests. The record says the vulnerability was patched on April 15, 2026, and that no customer action is needed. It assigns CWE-862, Missing Authorization, and CVSS 4.0 score 8.5, severity High, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear. The record's reference is bulletin GCP-2026-043.
How to prevent it
CVE-2026-12715 says no customer action is needed. The bulletin says the fix has been deployed to the backend service. It says someone who stored API keys in a Firebase Studio workspace, for example a GEMINI_API_KEY, may rotate those keys as a precaution.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.