2025-06-12

What CVE-2025-48757 actually says about Lovable and row-level security

On 29 May 2025 Matt Palmer published a write-up of CVE-2025-48757. The CVE record describes an insufficient row-level security policy in Lovable through 15 April 2025. It says a remote attacker without an account could read or write arbitrary database tables of generated sites. The record lists CWE-863 (incorrect authorisation) and a CVSS 3.1 base score of 9.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. The record was updated on 21 August 2025.

The same record includes a note that the supplier disputes the CVE, because each Lovable customer accepts responsibility for protecting their application's data. Palmer's write-up says the issue is missing or insufficient row-level security on databases used by Lovable projects, including projects that use an external database, and that it can affect projects created on or before 15 April 2025 and may also affect later ones. He describes the practical result as data, including personal data, being reachable with the public anon key when policies do not match the app's rules. He also says some projects could be written to.

That is the whole shape of the issue. The anon key is not the bug. The bug is a policy that does not restrict rows. Palmer's suggested workaround is the one Supabase documents as well: enable row-level security on every table, and write policies that match the real rule (for example a signed-in user reading only their own rows). He warns against policies that are always true on sensitive tables. Lovable's own publish checks can tell you that row-level security is off. They do not tell you that a policy is too wide.

LeakSweep's Deep Scan is aimed at that gap. It uses the public key only, asks for a row count with a body-less request, and sends a write that names a column which does not exist so a normal database rejects it before saving. It does not download rows, and it is not a review of every policy you wrote by hand. If a count comes back, the report says so in plain English and gives you a prompt to paste into the builder.

This note is general information. It is not a notice from Lovable, and it is not a penetration test.