CVE-2026-65013 – Onlook tRPC Insecure Direct Object Reference via multiple procedures

CVE ID :CVE-2026-65013

Published : 22 juillet 2026 17:16 | 29 minutes ago

Description :Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users’ resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users’ project data, members, and conversation history.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…