CVE-2026-65013
Onlook tRPC Insecure Direct Object Reference via multiple procedures
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.
| CWE | CWE-639 |
| Vendor | onlook |
| Product | repo |
| Published | Jul 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for onlook repo
Be the first to know when new high vulnerabilities affecting onlook repo are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
onlook / repo
0 ≤ 0.2.32
References
github.com: https://github.com/onlook-dev/onlook/issues/3122 github.com: https://github.com/onlook-dev/onlook/pull/3129 github.com: https://github.com/onlook-dev/onlook/commit/423e2e924366419e418ee049093872d535eea41a vulncheck.com: https://www.vulncheck.com/advisories/onlook-trpc-insecure-direct-object-reference-via-multiple-procedures
Credits
George Chen