CVE-2026-65013: Onlook Auth Bypass Vulnerability

CVE-2026-65013 Overview

CVE-2026-65013 is a broken object level authorization vulnerability in Onlook through version 0.2.32, an open-source visual editor for web applications. The flaw exists in multiple tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Authenticated attackers can supply arbitrary UUID values as projectId or conversationId parameters to access resources belonging to other users. The tRPC procedures accept these identifiers without validating that the authenticated user has permission to act on the referenced object. Exploitation permits reading, modifying, and deleting other users' projects, project members, and conversation history. The vulnerability is fixed in commit 423e2e9. This weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Onlook user can enumerate UUIDs to read, modify, or delete arbitrary projects, remove members from other tenants' projects, and delete other users' conversation histories.

Affected Products

Onlook versions up to and including 0.2.32
Onlook tRPC routers: project, member, and chat.conversation
Onlook deployments prior to commit 423e2e924366419e418ee049093872d535eea41a

Discovery Timeline

2026-07-22 - CVE-2026-65013 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65013

Vulnerability Analysis

Onlook exposes a tRPC API where protected procedures accept object identifiers directly from client input. The affected procedures — project.get, member.remove, and chat.conversation.delete — perform database operations keyed by the caller-supplied UUID without verifying ownership or membership. An authenticated attacker who obtains or guesses a valid projectId or conversationId can invoke these procedures against resources they do not own. The impact spans confidentiality, integrity, and availability: attackers read sensitive project metadata, remove legitimate collaborators from projects, and destroy conversation history belonging to other tenants.

Root Cause

The root cause is missing authorization checks between authentication and data access. The tRPC protectedProcedure middleware confirms that a session exists but does not enforce object-level access control. Router handlers execute Drizzle ORM queries such as eq(conversations.projectId, input.projectId) directly against user-supplied identifiers. Because no join or predicate ties the query to ctx.user.id, the database returns records regardless of ownership.

Attack Vector

An authenticated attacker calls a vulnerable tRPC procedure over the network with a target UUID belonging to another user. UUIDs may be harvested through shared links, prior collaboration, error messages, or brute-force enumeration where predictable. No user interaction from the victim is required. The patch introduces verifyProjectAccess, verifyConversationAccess, and verifyMessagesAccess helpers that must be awaited before each query executes.

typescript

// Security patch: apps/web/client/src/server/api/routers/chat/conversation.ts
 import { v4 as uuidv4 } from 'uuid';
 import { z } from 'zod';
 import { createTRPCRouter, protectedProcedure } from '../../trpc';
+import { verifyConversationAccess, verifyProjectAccess } from '../project/helper';
 
 export const conversationRouter = createTRPCRouter({
     getAll: protectedProcedure
         .input(z.object({ projectId: z.string() }))
         .query(async ({ ctx, input }) => {
+            await verifyProjectAccess(ctx.db, ctx.user.id, input.projectId);
             const dbConversations = await ctx.db.query.conversations.findMany({
                 where: eq(conversations.projectId, input.projectId),
                 orderBy: (conversations, { desc }) => [desc(conversations.updatedAt)],

Source: Onlook commit 423e2e9. The fix enforces project-membership authorization before the database query executes. A parallel change wraps messageRouter.getAll with verifyConversationAccess(ctx.db, ctx.user.id, input.conversationId) to prevent cross-tenant reads of message history.

Detection Methods for CVE-2026-65013

Indicators of Compromise

tRPC request logs showing a single authenticated user invoking project.get, member.remove, or chat.conversation.delete against many distinct projectId or conversationId values in a short time window.
Application audit records for member.remove operations where the acting user is not the project owner or an administrator.
Unexpected deletions of conversations rows without a corresponding request from the resource owner's session.

Detection Strategies

Instrument the affected tRPC procedures with structured logging that captures ctx.user.id, target UUID, and ownership status, then alert when they diverge.
Add server-side telemetry for authorization failures once the patch is deployed to surface active exploitation attempts.
Correlate database DELETE statements on conversations and project_members with the initiating user identity to detect cross-tenant activity.

Monitoring Recommendations

Baseline the normal fan-out of projectId values per user account and alert on anomalies.
Retain reverse-proxy or API-gateway logs for tRPC endpoints so historical exploitation can be reconstructed.
Review database backups for evidence of unauthorized modifications prior to applying the patch.

How to Mitigate CVE-2026-65013

Immediate Actions Required

Upgrade Onlook to a build that includes commit 423e2e924366419e418ee049093872d535eea41a or later.
Audit conversations, messages, projects, and project_members tables for records that may have been altered or removed by unauthorized users.
Rotate any project-scoped secrets or API tokens that could have been exposed through the project.get procedure.

Patch Information

The fix is delivered in Onlook commit 423e2e9 and tracked in pull request #3129. The commit adds verifyProjectAccess, verifyConversationAccess, and verifyMessagesAccess helpers and calls them at the top of each affected tRPC handler. Additional context is available in the GitHub issue #3122 and the VulnCheck Security Advisory.

Workarounds

Restrict access to the Onlook application to trusted users until the patch is applied, since any authenticated account can exploit the flaw.
Deploy a reverse-proxy rule that blocks the vulnerable tRPC procedures for accounts that do not require them.
Fork the affected routers and add ownership checks manually if an immediate upgrade is not feasible.

bash

# Verify the fix commit is present in your deployment
git -C /path/to/onlook log --oneline | grep 423e2e9

# Or pull the latest main branch containing the authorization helpers
git -C /path/to/onlook fetch origin
git -C /path/to/onlook checkout main
git -C /path/to/onlook pull --ff-only