Onlook
Monthly
Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Broken object-level authorization in Onlook through version 0.2.32 allows authenticated attackers to read, modify, and delete other users' projects, members, and chat conversations by passing arbitrary projectId or conversationId UUIDs to tRPC procedures such as project.get, member.remove, and chat.conversation.delete. Because the affected procedures trusted client-supplied identifiers without verifying the caller's ownership, any logged-in user could reach cross-tenant data. Publicly available exploit material exists (VulnCheck advisory and a GitHub issue), and the vendor has shipped a fix in commit 423e2e9, though there is no public exploit identified as being used in active attacks.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.