CVE-2025-48757
An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generat…
Published: 2025-05-30 · CVSS: 9.3 · CVSS 3.1
An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7