Lovable-generated sites with missing RLS let unauthenticated users read or write tables
On May 30, 2025, CVE-2025-48757 was published for Lovable. It says an insufficient row level security policy through April 15, 2025 let remote unauthenticated attackers read or write arbitrary database tables on generated sites. The record rates that Critical, CVSS 3.1 score 9.3, and notes that the supplier disputes it.
What was reported
CVE-2025-48757, published May 30, 2025, says an insufficient database row level security policy in Lovable through April 15, 2025 allows remote unauthenticated attackers to read or write arbitrary database tables of generated sites. The record assigns CWE-863, Incorrect Authorization, and CVSS 3.1 score 9.3, severity Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. Its affected range is version 0 through 2025-04-15.
The same record says the supplier disputes this, because each individual customer of the Lovable platform accepts responsibility for protecting the data of their application.
Matt Palmer's write-up, dated May 29, 2025, describes the same identifier. The write-up credits Matt Palmer as the discoverer and lists the organization as Replit, Inc. It scores the issue at a CVSS 3.1 base of 8.26 with Scope Unchanged. CVE-2025-48757 scores it 9.3 with Scope Changed, and the record is tagged disputed and exclusively-hosted-service. The write-up lists "Fixed versions: None". It says a Lovable project that uses a database can ship with row level security that does not match the app. It says that includes projects created on or before April 15, 2025, and that projects created after that date may be affected too. It says the generated front end calls the database from the browser with the public anon key, and that a table with a missing or insufficient policy can be read or changed by altering that request. The write-up's workaround is to enable row level security, avoid policies such as USING (true) on a sensitive table, and keep API keys and other service credentials out of tables the client can query. It points to Supabase's row level security guide for the configuration steps.
How to prevent it
Check the database policies on a Lovable app that the browser can query. The CVE record says the supplier disputes the issue, because each customer is responsible for the application's data. Matt Palmer's write-up says to enable row level security on those tables, avoid a policy that allows every row of a sensitive table, and keep service credentials out of client-reachable tables.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.