A remote procedure call meant to block non-admin users from sensitive functions did the opposite: it blocked every logged-in user while letting unauthenticated requests straight through. That inverted check, repeated across several critical functions, sat in an exam-question and grading app built on Lovable — and featured on Lovable's own Discover showcase, where it had logged over 100,000 views and about 400 upvotes.
What the source says
The Register reports that security researcher Taimur Khan found the app had no working Supabase row-level security or role-based access control at all. The exposure reached 18,697 user records — 14,928 of them tied to a unique email address, including 4,538 student accounts and 10,505 enterprise users, with 870 users' full personal information exposed. Per Khan's account, an unauthenticated attacker could read every record, send bulk emails through the platform, delete accounts outright, grade students' real exam submissions, and reach organizations' admin emails. Affected users reportedly included people from UC Berkeley and UC Davis, and possibly minors in K-12 programs.
Khan says his first report, filed through Lovable's own support channel, was closed without a response. Lovable told The Register it received "a proper disclosure report" on the evening of February 26, 2026, and acted "within minutes" of that. Lovable's CISO, Igor Andriushchenko, said every project includes a free pre-publish security scan, but that acting on its recommendations is "at the discretion of the user" — and noted the project also contained code Lovable did not generate and a database Lovable does not host.
What it doesn't establish
Lovable said it had contacted the app's creator, who was "now addressing the issue," but no independent confirmation that the flaw was fixed has been reported. There's no public record of whether anyone besides Khan accessed the exposed data during the window it was live. This is also a distinct incident from two other Lovable authorization failures we track separately: CVE-2025-48757 (an RLS scan across roughly 170 apps) and a platform-wide BOLA bug (STUPID-2026-0149) — same vendor, three separate authorization failures within the same year.
Why it's still worth logging
"At the discretion of the user" is a reasonable policy for a security scan's recommendations in general. It's a harder sentence to stand behind when the user in question built an exam-grading tool, the platform's own Discover algorithm promoted it to 100,000 views, and the access-control bug ran backwards — keeping legitimate users out while leaving the door open to everyone else. A free pre-publish scan that nobody is required to read isn't a control; a featured listing is Lovable vouching for the app to everyone who sees it, which is a different thing than a user's free choice.
Full record, severity scoring, and source: https://www.stupidllm.com/incident/STUPID-2026-0151/
Top comments (0)