2025 Lovable — CVE-2025-48757, 170 apps, RLS bypass
Data compromised
Emails, plans, Stripe IDs, API keys, addresses, payment status
Technical writeup
303 API endpoints across 170 Lovable apps leaked data. CVE-2025-48757 CVSS 9.3. Auth bypass via direct Supabase queries; no RLS. Emails, Stripe IDs, keys, addresses. Few lines of browser console to dump all users.
Root cause
Missing RLS; auth vs authorization confusion