Which versions of Onlook are affected by CVE-2026-65013?

Onlook versions through 0.2.32 contain a broken authorization vulnerability allowing authenticated users to access, modify, and delete other users' projects, team members, and chat conversations…. A patch is available.

Is there a public PoC exploit available for CVE-2026-65013?

Yes, a public proof-of-concept exploit is available for CVE-2026-65013. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-65013?

Within 24 hours, identify all Onlook instances in your infrastructure and confirm which versions are deployed; if any system runs version 0.2.32 or earlier, initiate an assessment of access logs for evidence of unauthorized cross-account data access and isolate affected projects from use if exploitation is suspected. Within 7 days, apply the vendor patch per security advisory to all Onlook deployments and verify successful updates across your environment. Within 30 days, conduct comprehensive audit log review for suspicious cross-account access patterns, reset authentication credentials for all projects that were potentially exposed, and communicate the vulnerability and remediation status to all affected users.

Onlook CVE-2026-65013

Q: What is the CVSS score of CVE-2026-65013?

CVE-2026-65013 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-47745 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-22 VulnCheck

GHSA-j6x3-f5cf-2pg4

Authentication Bypass Onlook Repo

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Any authenticated user can remotely and reliably access other tenants' data via arbitrary UUIDs, giving PR:L, AC:L, no UI, and high C/I/A on victim resources with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 17:17 vuln.today

Analysis Generated

Jul 22, 2026 - 17:17 vuln.today

CVE Published

Jul 22, 2026 - 16:14 cve.org

HIGH 8.7

DescriptionCVE.org

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

AnalysisAI

Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.

Technical ContextAI

Onlook is an open-source, AI-assisted visual editor for building web/React applications; its web client exposes a tRPC API backed by a Drizzle ORM (Postgres-style) datastore. The flaw is a classic CWE-639 Authorization Bypass Through User-Controlled Key (IDOR/BOLA): procedures accepted a caller-supplied UUID (projectId, conversationId, messageId) and queried the record directly - e.g. the pre-patch message router did db.query.conversations.findFirst({ where: eq(conversations.id, conversationId) }) with only an existence check - without confirming the authenticated user actually owns or is a member of that resource. The fix introduces centralized ownership guards (verifyProjectAccess, verifyConversationAccess, verifyMessagesAccess) invoked on every affected procedure, and additionally forces inserted messages onto the authorized conversation to prevent a caller from smuggling messages into another conversation via array payloads. The CPE cpe:2.3:a:onlook:repo identifies the affected component as the Onlook repository/web client codebase.

RemediationAI

Upgrade to an Onlook build that includes the fix from commit 423e2e9 (pull request #3129), which is the primary and complete remediation - it adds server-side ownership checks (verifyProjectAccess, verifyConversationAccess, verifyMessagesAccess) to the affected tRPC procedures and pins inserted messages to the authorized conversation; a released patched version number is not stated in the input, so track the commit/PR rather than a version tag until the vendor tags a release. If you cannot immediately deploy the patched code, self-hosters can apply the diff directly from the commit, or as a stopgop restrict the application to trusted users only and monitor tRPC access to project.get, member.remove, chat.conversation.delete, and message procedures for cross-user UUID access - noting these controls do not close the underlying authorization gap and may not stop a determined authenticated attacker. Refer to the VulnCheck advisory (https://www.vulncheck.com/advisories/onlook-trpc-insecure-direct-object-reference-via-multiple-procedures) and the GitHub commit (https://github.com/onlook-dev/onlook/commit/423e2e924366419e418ee049093872d535eea41a) for verification.