STUPID-2026-0031

Lovable-built apps inverted access control, exposing 170+ production databases (CVE-2025-48757)

10.0critical
May 1, 2025Verified

  1. Instruction given

    Build an app with authentication and per-user data access.

  2. Expected behavior

    Restrict each user to their own records; unauthenticated visitors should have no access to protected data.

  3. Actual behavior

    The AI implemented access control using Supabase remote procedure calls but inverted the logic, so unauthenticated visitors had full access to all data. The flaw shipped across more than 170 production applications.

  4. Damage

    Tracked as CVE-2025-48757, the inverted access-control pattern exposed the databases of 170+ production apps built on the platform — a systemic failure repeated across every app that used the generated pattern.

Apps built with the AI app-builder Lovable shipped with inverted access-control logic, tracked as CVE-2025-48757. The generated code implemented authorization using Supabase remote procedure calls but reversed the condition, so unauthenticated visitors were granted full access to all data instead of being denied it. Because the flawed pattern was reproduced by the generator, it appeared across more than 170 production applications at once. It is a textbook case of AI-generated code that is functionally plausible — it compiles, runs, and looks correct — while silently getting the single most important security decision exactly backwards.

Classification

Agent
Lovable
Failure mode
Security Vulnerability
Root cause
Logic Error
Domain
Backend
Source
News Report

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Clinejection: an AI issue-triage workflow enabled arbitrary code execution on the CI runner
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.