CyberRota Analysis
AI-GeneratedA broken object level authorization vulnerability in Onlook versions up to 0.2.32 allows authenticated attackers to exploit tRPC API procedures, enabling them to access and manipulate other users' resources by supplying arbitrary UUID values. This could lead to unauthorized reading, modification, or deletion of project data, member information, and conversation history. Organizations using affected versions should prioritize patching this vulnerability to safeguard user data and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.