Lovable-built apps inverted access control, exposing 170+ production databases (CVE-2025-48757)
10/10
Severity
Security Vulnerability
Failure Mode
Reproducible
No
Date
May 1, 2025
Expected Behavior
Restrict each user to their own records; unauthenticated visitors should have no access to protected data.
What Actually Happened
The AI implemented access control using Supabase remote procedure calls but inverted the logic, so unauthenticated visitors had full access to all data. The flaw shipped across more than 170 production applications.
Damage Assessment
Tracked as CVE-2025-48757, the inverted access-control pattern exposed the databases of 170+ production apps built on the platform — a systemic failure repeated across every app that used the generated pattern.
Full Report
Apps built with the AI app-builder Lovable shipped with inverted access-control logic, tracked as CVE-2025-48757. The generated code implemented authorization using Supabase remote procedure calls but reversed the condition, so unauthenticated visitors were granted full access to all data instead of being denied it. Because the flawed pattern was reproduced by the generator, it appeared across more than 170 production applications at once. It is a textbook case of AI-generated code that is functionally plausible — it compiles, runs, and looks correct — while silently getting the single most important security decision exactly backwards.
Incident Metadata
- Agent
- Lovable
- Failure Mode
- Security Vulnerability
- Root Cause
- Logic Error
- Task Type
- feature
- Domain
- backend
- Source
- news_report