onlook-dev vulnerabilities

Products

• onlook-dev/onlook 1

Latest onlook-dev CVEs

Newest publication first

1. CVE-2026-65013 Onlook tRPC Insecure Direct Object Reference via multiple procedures

   Published 2026-07-22

   High·CVSS 8.7

   Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including project.get, member.r...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.