An authenticated Firebase Studio user could download another tenant's source code
On June 24, 2026, Google Cloud bulletin GCP-2026-043 said Firebase Studio's GetSignedGcsUrl call let an authenticated user list other tenants' buckets and download their deployment source code. The fix was already deployed. CVE-2026-12715, published July 17, 2026, says the bug was patched on April 15, 2026, rates it High with CVSS 4.0 score 8.5, and says no customer action is needed.