Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-65013

Onlook tRPC Insecure Direct Object Reference via multiple procedures

CVSS 4.0 8.7 HIGHCVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-65013

Published

Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-65013

Published

repo

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "onlook",
                    "product": "repo",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:github/onlook-dev/onlook",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThanOrEqual": "0.2.32"
                        },
                        {
                            "status": "unaffected",
                            "version": "423e2e924366419e418ee049093872d535eea41a",
                            "versionType": "git"
                        }
                    ],
                    "repo": "https://github.com/onlook-dev/onlook"
                }

Original source record · Cite this exact observation · Complete original publisher JSON