Firebase Studio

1 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2026-12715 HIGH PATCH This Week

Cross-tenant data disclosure in Google Cloud Firebase Studio (versions prior to the 2026-04-15 fix) let an authenticated user retrieve other tenants' deployed source code and sensitive data by issuing unauthorized GCS signed-URL requests. The flaw stems from a missing authorization check (CWE-862) on the object-signing path rather than a code-execution bug, so impact is confidentiality-centric. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Google Information Disclosure Authentication Bypass Firebase Studio

NVD

CVSS 4.0

8.5

EPSS

0.2%

CVE-2026-12715

EPSS 0% CVSS 8.5

HIGH PATCH This Week

Cross-tenant data disclosure in Google Cloud Firebase Studio (versions prior to the 2026-04-15 fix) let an authenticated user retrieve other tenants' deployed source code and sensitive data by issuing unauthorized GCS signed-URL requests. The flaw stems from a missing authorization check (CWE-862) on the object-signing path rather than a code-execution bug, so impact is confidentiality-centric. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Google Information Disclosure Authentication Bypass +1

NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy