Lovable's third strike: a free account and five API calls opened other tenants' code and credentials
- Date
- Apr 20, 2026
- Tools involved
- Lovable
- Impact
- Source code, database credentials, AI chat history, and customer data of Lovable projects created before November 2025 readable by any free account in as few as five API calls
- Root cause
- Broken Object Level Authorization (BOLA) in Lovable's API; reported March 3, 2026, and left unfixed for 48 days until public disclosure forced a patch
What happened
On April 20, 2026, security researcher @weezerOSINT publicly disclosed a mass data exposure affecting Lovable projects. The flaw was Broken Object Level Authorization, BOLA: the API checked that you were a Lovable user but not that the object you were requesting belonged to you. By creating a free Lovable account, anyone could access another tenant's profile, public projects, source code, database credentials, AI chat history, and customer data, in as few as five API calls.
The scope was wide. Reporting indicated that projects created before November 2025 were broadly exposed. Separately, between February 3 and April 20, 2026, public project chat history and source code could be accessed by any Lovable user who had a project link.
The timeline drew as much fire as the bug. The researcher said the flaw had been reported to Lovable on March 3, 2026, and sat unaddressed for 48 days. Once the disclosure went public, Lovable shipped a fix within about two hours, which answered the technical question of how hard the fix was and raised the organizational question of why it took a public post to trigger it.
Lovable, then valued around $6.6 billion with millions of users, publicly disputed the framing, characterizing some of the access as 'intentional behavior' of public projects rather than a breach. The dispute is over framing, not the underlying mechanics, which the researcher documented and outlets including The Register and TNW covered.
This was Lovable's third major security incident in about thirteen months, following CVE-2025-48757 in May 2025 (the missing-RLS mass leak) and a February 2026 incident reported to have exposed roughly 18,000 user records tied to university projects. Coverage framed the run of incidents as evidence of a structural security problem in the vibe coding model: when the platform holds everyone's source code, credentials, and chat history, one authorization bug is everyone's breach.
Impact
Any free Lovable account could read other tenants' profiles, source code, database credentials, AI chat history, and customer data in as few as five API calls, with projects created before November 2025 broadly exposed. Database credentials are the multiplier here: leaking source code is bad, but leaking the keys to the databases behind live apps extends the blast radius to those apps' end users. Between February 3 and April 20, 2026, public project chat history and source code were also accessible to any Lovable user with a project link. Lovable at the time was valued around $6.6 billion and served millions of users, and this was its third major security incident in about thirteen months.
Root cause
The vulnerability was Broken Object Level Authorization: Lovable's API authenticated the caller but did not verify that the requested object, another tenant's project data, belonged to that caller. Authentication without per-object authorization is the classic BOLA failure, and here it gated source code, database credentials, and chat history. The process failure compounded it: the researcher reported the bug on March 3, 2026, it went unaddressed for 48 days, and the fix that shipped roughly two hours after public disclosure demonstrated the patch itself was never the hard part.
How to not be this entry
- Check object ownership on every API route, not just login. Every request for a project, file, or credential must verify the authenticated caller actually owns that specific object. BOLA is authentication without authorization. Read the fix guide: No auth on your AI-generated API endpoints: anyone can call your backend
- Assume anything your platform stores can be served by its API someday. Database credentials and secrets held inside a builder platform inherit every authorization bug that platform ever ships; rotate credentials after any platform incident. Read the fix guide: Lovable API key exposed: secrets visible in your client-side code
- Learn your platform's public/private semantics precisely. In this incident, 'public project' meant chat history and source code were readable by any user with a project link for over two months. Never paste secrets into AI chat on a hosted builder.
- If you run a platform, make disclosure response a paged incident, not a ticket. This bug waited 48 days after a private report and was fixed about two hours after a public one; the delta is pure process. Read the fix guide: Lovable Supabase RLS not enabled: anyone can read your app's data (CVE-2025-48757)
Tools that actually fix this
Recommended because they address the failure mode above, not because of the payout. Some are affiliate links; see how we choose.
If your AI-built app uses Supabase, Row Level Security is the actual fix for exposed data, and it is free. The dashboard's Security Advisor lists every table you left open.
Try Supabase →Drop-in authentication that handles sessions, tokens, and protected routes properly, so you stop shipping the hand-rolled auth an AI guessed at. Generous free tier for a real app.
Try Clerk →Frequently asked questions
What happened in the Lovable April 2026 breach?
On April 20, 2026, researcher @weezerOSINT disclosed a Broken Object Level Authorization (BOLA) flaw in Lovable that let any free account access other tenants' source code, database credentials, AI chat history, and customer data in as few as five API calls. Projects created before November 2025 were reported as broadly exposed, and Lovable fixed the flaw about two hours after public disclosure.
What is a BOLA vulnerability?
BOLA, Broken Object Level Authorization, is an API flaw where the server verifies that a caller is logged in but not that the specific object they requested belongs to them. In Lovable's April 2026 incident, any authenticated free account could request other tenants' project objects, including source code and database credentials, and the API served them.
How did Lovable respond to the April 2026 disclosure?
Lovable shipped a fix within about two hours of the public disclosure on April 20, 2026, after the researcher said the bug had been privately reported on March 3, 2026 and sat unaddressed for 48 days. Lovable publicly disputed the framing of the incident, characterizing some of the access as 'intentional behavior' of public projects rather than a breach.
Who was affected by the Lovable BOLA flaw?
Reporting indicated Lovable projects created before November 2025 were broadly exposed, meaning their source code, database credentials, AI chat history, and customer data could be read by any free Lovable account. Additionally, between February 3 and April 20, 2026, public project chat history and source code could be accessed by any Lovable user with a project link.
Was this Lovable's first security incident?
No, the April 2026 BOLA breach was Lovable's third major security incident in about thirteen months. It followed CVE-2025-48757 in May 2025, where about 10 percent of scanned Lovable apps leaked data through missing Row Level Security, and a February 2026 incident reported to have exposed roughly 18,000 user records tied to university projects.
Sources
- The Register: Lovable denies data leak, cites 'intentional behavior' of public projects
- TNW: Lovable's vibe coding security crisis exposed
- Lovable: Our response to the April 2026 incident
Related error guides
No auth on your AI-generated API endpoints: anyone can call your backend
Lovable API key exposed: secrets visible in your client-side code
Lovable Supabase RLS not enabled: anyone can read your app's data (CVE-2025-48757)
The Vibe Oops briefing
One email when something ships to production that should not have. New incidents, new error guides, no filler.