Lovable's API didn't check whether an account calling it actually owned the project it was asking about — a broken object-level authorization (BOLA) bug. Security researcher @weezerOSINT found that five API calls from a brand-new free account were enough to reach another user's profile, their public projects, that project's source code, and the Supabase database credentials hardcoded inside it. AI chat histories on public projects were exposed too.
What the source says
The Register reports that the researcher filed the bug through Lovable's HackerOne bug-bounty program on March 3, 2026. HackerOne marked the report a duplicate and left it open rather than escalating it internally, and the bug stayed exploitable for 48 days.
Lovable's first public statement, issued after the researcher's disclosure on April 20, denied there had been a breach — "To be clear: We did not suffer a data breach" — and described the code exposure as "intentional behavior," attributing it to unclear documentation of what "public" meant on the platform. Lovable then issued a second, more candid statement: a backend permissions change in February 2026 had "accidentally re-enabled access to chats on public projects," and the HackerOne reports describing the problem "were closed without escalation to our internal team" because Lovable's bug-bounty partners believed the behavior was intended. The company reverted the change, and public-project chats are private again.
What it doesn't establish
The Register's reporting is built on Lovable's own statements, not an independent security audit — which is why this entry carries verified: false in our scoring despite the severity. Whether anyone besides the researcher actually read another user's data during the 48-day window, and how many projects were reachable in practice, isn't established by the source. This is also a distinct incident from the Row-Level-Security bug we track separately (CVE-2025-48757, STUPID-2026-0031) — same vendor, two different authorization failures, about three months apart.
Why it's still worth logging
A bug-bounty program that marks a live, exploitable BOLA bug "duplicate" without escalating it is its own failure mode, separate from the underlying code defect. And the sequence of public statements — flat denial, then "intentional behavior," then an admission that permissions were accidentally reopened and the bounty reports mishandled — is a case study in how a vendor's first explanation of a security incident can be wrong in ways only a second statement corrects. For anyone with real credentials sitting inside a Lovable project today, the useful question isn't just "was this fixed" but "what would it take for the next one to get escalated the first time."
Full record, severity scoring, and source: https://www.stupidllm.com/incident/STUPID-2026-0149/
Top comments (0)