Which versions of Firebase Studio are affected by CVE-2026-12715?

Google Cloud Firebase Studio contains a missing authorization control in the object-signing path that allows unauthorized retrieval of other tenants' deployed source code and sensitive data via GCS…. A patch is available.

How to fix or mitigate CVE-2026-12715?

Within 24 hours, identify all Google Cloud projects using Firebase Studio and classify the sensitivity of deployed code, credentials, and configuration data. Within 7 days, implement stricter IAM policies on GCS object-signing permissions for Firebase Studio service accounts, enable and baseline Cloud Audit Logs specifically for signed-URL operations to detect unauthorized cross-tenant requests, and conduct an initial audit of deployed code for exposed credentials or business logic. Within 30 days, evaluate upgrading to Firebase Studio versions released after April 15, 2026 when patches become available, or implement temporary isolation of business-critical applications from Firebase Studio pending vendor patch release.

Firebase Studio CVE-2026-12715

Q: What is the CVSS score of CVE-2026-12715?

CVE-2026-12715 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

EUVD-2026-45187 HIGH

Missing Authorization (CWE-862)

2026-07-17 GoogleCloud

GHSA-cfq8-274p-7h5p

Authentication Bypass Information Disclosure Google Firebase Studio Google Cloud

8.5

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

7.7 HIGH

Network-reachable signing endpoint (AV:N/AC:L) needs a valid low-priv account (PR:L); reading another tenant's data crosses an authorization boundary (S:C) with confidentiality-only impact (C:H, I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 17:02 EUVD

Analysis Generated

Jul 17, 2026 - 16:01 vuln.today

CVE Published

Jul 17, 2026 - 15:09 cve.org

HIGH 8.5

DescriptionCVE.org

Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests.

This vulnerability was patched on 15 April 2026, and no customer action is needed.

AnalysisAI

Cross-tenant data disclosure in Google Cloud Firebase Studio (versions prior to the 2026-04-15 fix) let an authenticated user retrieve other tenants' deployed source code and sensitive data by issuing unauthorized GCS signed-URL requests. The flaw stems from a missing authorization check (CWE-862) on the object-signing path rather than a code-execution bug, so impact is confidentiality-centric. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Firebase Studio is Google's cloud-hosted development environment (the successor to Project IDX) where users edit, build, and deploy application source code stored as objects in Google Cloud Storage (GCS). To serve those objects, the platform mints time-limited GCS signed URLs on the user's behalf. The root cause is CWE-862 (Missing Authorization): the URL-signing endpoint signed requests for GCS objects without verifying that the requesting principal actually owned the targeted resource, so a signed URL could be obtained for another tenant's deployment artifacts. The single CPE identifies the affected component as cpe:2.3:a:google_cloud:firebase_studio, a multi-tenant SaaS service, which is why the failure is an authorization/isolation gap in shared cloud infrastructure rather than a client-side or library defect.

RemediationAI

No customer action is required: Google remediated the flaw server-side in the Firebase Studio backend on 2026-04-15, so the fix is applied automatically to the hosted service (treat this as 'Patch available per vendor advisory', with the fix dated 2026-04-15 rather than a customer-installable version number). Organizations should review the Google Cloud bulletin at https://docs.cloud.google.com/support/bulletins#gcp-2026-043, and - because the exposed data was other users' deployed source code and sensitive data - consider rotating any secrets, API keys, or credentials that may have been committed to or deployed through Firebase Studio during the pre-fix exposure window as a precaution, since a signed-URL leak of source could have disclosed embedded secrets. No client-side workaround is needed given the service-side nature of the fix.