Approved changes feed: RSS · Atom
cpe:2.3:a:onlook:repo:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Onlook (fbb381d4-35f8-5101-99ef-9661e28c7848) |
|---|---|
| Product | Repo (64763d35-3bfa-5119-bc07-2a58b34ed4b0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-65013 |
vulnerable | 2026-07-29 01:06:19.928559 |
Onlook tRPC Insecure Direct Object Reference via multiple procedures
HIGH (8.8)
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.remove, and chat.conversation.delete. Attackers can provide arbitrary projectId or conversationId values without authorization validation to read, modify, and delete other users' project data, members, and conversation history.
Published: 2026-07-22T16:14:23.346Z
Updated: 2026-09-17T17:54:34.536Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.