STUPID-2026-0149
A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it
Why 9/10
Any free account could reach other users' projects platform-wide, and a researcher demonstrated pulling real source code and database credentials; whether anyone besides the researcher exploited it before the fix is not established.
- Scope
- 4/4
- Many organisations or the public: a flaw in a widely used product, mass exposure, a large outage
- Recoverability
- 2/3
- Partly lost, or loss reported without saying whether it was recovered
- Did it happen
- 2/2
- Happened in real use
- Beyond the user
- 1/1
- Production systems, customers or third parties, or credentials and sensitive personal data
The score is the sum of these four factors. How each factor is scored · scored 2026-10-29
Instruction given
Not a single user's request to an agent — Lovable's own API, which backs every account's public projects, was the system under test.
Expected behavior
Restrict a project's source code, database credentials and AI chat history to that project's own owner; a free account on someone else's public project should see only what the owner intended to make public.
Actual behavior
Lovable's API did not check that a requesting account owned the project it was asking about (a broken object-level authorization bug). Security researcher @weezerOSINT reported that from a free account, five API calls were enough to reach another user's profile, their public projects and that project's source code, from which Supabase database credentials could then be read directly.
Damage
Source code, hardcoded Supabase database credentials, and AI chat histories across Lovable's public projects were readable by any free account, platform-wide, for the projects affected. The researcher reported the flaw to Lovable's HackerOne bug bounty program on March 3, 2026; HackerOne marked it a duplicate and left it open, and it stayed exploitable for 48 days until Lovable's public response on April 20, 2026. Lovable first said "we did not suffer a data breach" and called the code exposure "intentional behavior," then reversed course, acknowledging it had "accidentally re-enabled access to chats on public projects" during a February backend permissions change and that the HackerOne reports "were closed without escalation to our internal team." It reverted the change so public-project chats are private again. Whether any party besides the researcher accessed other users' data during the 48-day window is not established.
Full write-up
Security researcher @weezerOSINT reported that Lovable's API had a broken object-level authorization (BOLA) bug: it did not verify that a requesting account owned the project it was querying. From a newly created free account, five API calls were enough to reach another user's profile, that user's public projects, and the project's source code — from which Supabase database credentials could then be read directly out of the code. AI chat histories on public projects were also exposed.
The researcher reported the flaw to Lovable's HackerOne bug bounty program on March 3, 2026. HackerOne marked the report a duplicate and left it open rather than escalating it internally. The bug remained exploitable for 48 days, until the researcher's public disclosure prompted Lovable's first statement on April 20, 2026.
That first statement denied there had been a breach — "To be clear: We did not suffer a data breach" — and described the code exposure as "intentional behavior," while blaming unclear documentation of what "public" meant. Lovable then issued a second, more candid statement: in February 2026, a backend permissions change had "accidentally re-enabled access to chats on public projects," and the HackerOne reports describing it "were closed without escalation to our internal team" because Lovable's bug-bounty partners believed the behavior was intended. A company spokesperson said Lovable only learned of the issue on April 20 and "addressed it as soon as we learned about it," reverting the change so chats on public projects are private again.
The Register, which first reported Lovable's statements, does not establish whether anyone besides the researcher accessed other users' source code, credentials or chats during the 48 days the bug was live. Lovable had separately made its projects private-by-default in December 2025, a change the February permissions update partially undid for chat visibility.
Classification
- Agent
- Lovable
- Failure mode
- Security Vulnerability
- Root cause
- Logic Error
- Domain
- Backend
- MIT AI Risk Repository (our mapping)
- 2.2 AI system security vulnerabilities and attacks · 2.1 Compromise of privacy by leaking or correctly inferring sensitive information taxonomy
- Source
- Security Research
Related incidents
Cite this record
StupidLLM. "STUPID-2026-0149: A broken object-level authorization bug let any free Lovable account pull other users' source code, Supabase credentials and AI chat histories for 48 days before Lovable fixed it." AI Agent Incident Database, 2026. https://www.stupidllm.com/incident/STUPID-2026-0149/ (accessed 2026-10-29). CC BY 4.0.
← STUPID-2026-0148By ID
Get told when an agent breaks something
We document AI agent failures daily, severity-scored against a published scale. Each Monday, if any scored 7 or above that week — deleted data, leaked secrets, broken production — you get one email with the sources. When nothing did, you get nothing.
This database is callable over MCP — query it from inside your agent.