VibeCVE-2025-48757: missing Row Level Security in Lovable-generated apps (170 of 1,645 scanned)
Summary
Researcher Matt Palmer scanned the homepages of 1,645 Lovable projects in March 2025 and found 303 database endpoints across 170 projects (about 10.3%) with RLS settings that let unauthenticated visitors read or write data. Exposed data included emails, phone numbers, payment details and API keys. NVD lists it as CVSS 9.3. Lovable disputes the CVE, saying each customer is responsible for protecting their app's data.
Severity
Timeline
Issue discovered.
Scan of 1,645 projects completed; Lovable notified.
Lovable acknowledges the report.
Lovable releases a security scan feature (listed as the patch release in Palmer's timeline).
Public disclosure. NVD publishes CVE-2025-48757 on May 30; Lovable disputes platform responsibility.
How it happened
Lovable apps talk to Supabase directly from the browser with the anon key. That design depends on RLS policies being present and correct on every table. Where policies were missing or were effectively 'true for everyone', changing a request (for example adding ?select=*) returned other users' rows. Lovable later introduced a security scanner. Palmer's view is that it only checks whether an RLS policy exists, not whether it is correct.
How to check your app
- Enable RLS on every table: ALTER TABLE ... ENABLE ROW LEVEL SECURITY;
- Look for policies with USING (true) on tables that hold user data and replace them with auth.uid()-based checks.
- Use your browser's network tab on your live app and replay the Supabase calls with ?select=* while logged out.
Sources
Corrections and updates
Clarified that the scan covered project homepages only, as the researcher states.
Expanded the timeline from the researcher's disclosure timeline (vendor notified Mar 21, acknowledged Mar 24, security scan released Apr 24, public May 29).
Replaced 'a check at publish time that warns when RLS is off' with the researcher's own description: a security scanner that only checks whether an RLS policy exists.