Lovable BOLA flaw left older projects readable for 48 days after it was reported

Vulnerability · Lovable · CRITICAL

Incident dateFeb 2026 (regression that re-enabled chat access, per Lovable). Start of the wider BOLA exposure: not stated.

DisclosedApr 20, 2026 (public, on X). Reported privately Mar 3, 2026.

Added hereOct 13, 11:49 PM ET

Last verifiedOct 14, 2026

Summary

A researcher (@weezerOSINT, Matt Palmer per Computing) reported a Broken Object Level Authorization flaw in Lovable's API through HackerOne on March 3, 2026. Any logged-in free account could request other users' project data, including source code, credentials and AI chat histories. Lovable added ownership checks for projects created after November 2025, but older projects were still reachable when the researcher disclosed the issue publicly 48 days later. Lovable first said it 'did not suffer a data breach', then acknowledged a February 2026 regression and closed off chat access on public projects.

Severity

CRITICAL Cross-tenant access to source code, credentials and chat histories with nothing more than a free account.

Timeline

Feb 2026
Per Lovable, a backend permissions change accidentally re-enabled access to chats on public projects.
Mar 3, 2026
Report filed through Lovable's HackerOne program; closed as a duplicate.
Mar 2026
Ownership checks shipped for newly created projects only. A follow-up report was also closed as a duplicate.
Apr 20, 2026
Public disclosure on X by @weezerOSINT, 48 days after the first report.
Apr 2026
Lovable says it did not suffer a data breach, then acknowledges the February regression, reverts it and makes public-project chats private.

How it happened

The /projects/{id} endpoints checked that the caller was logged in but not that they owned the project. That is the classic BOLA pattern, #1 on the OWASP API Security Top 10. Lovable's account is that HackerOne triage read the behavior as intended and closed the reports without escalating them; it said 'We'll do better.' Lovable still describes source visibility on projects marked public as intended.

How to check your app

If you have a Lovable project created before November 2025, check whether it is set to public and switch it to private if it should not be.
Rotate any secrets that ever appeared in code or in chat with the AI on that project (Supabase service keys, Stripe keys, API tokens).
In your own app, test every endpoint that takes an ID: log in as user A and request user B's record. You should get 403 or 404.

Sources

Corrections and updates

Oct 14, 2026
Changed 'older projects stayed reachable until the issue was disclosed' to 'were still reachable when it was disclosed'. Sources do not say access ended at disclosure.
Oct 14, 2026
Added Lovable's first response that it 'did not suffer a data breach', and dated the public disclosure to Apr 20, 2026.

If you would rather have someone look at your app for this kind of problem, LockedVibe runs security scans for vibe-coded apps. Their free Lockdown Pack is a good first step too.