On March 20th, 2025, we discovered a critical vulnerability in Lovable's implementation of Row Level Security (RLS) policies. Applications developed using its platform often lack secure RLS configurations, allowing unauthorized actors to access sensitive user data and inject malicious data. [...] Lovable later introduced a "security scanner," but it merely checks for the existence of any RLS policy, not its correctness or alignment with application logic. This provides a false sense of security, failing to detect the misconfigurations that expose data.
Lovable builds an application from a description, with Supabase behind it. Supabase enforces access at the database through row level security policies, so a generated app whose policies do not match its own login logic will happily serve one user's rows to anybody who edits the request, because the only thing stopping them was the front end. Palmer scanned 1,645 Lovable apps and found 170 of them, around one in ten, exposing data across 303 endpoints. He disclosed it, the 45-day window passed without a fix he considered adequate, and he published as CVE-2025-48757 on 29 May 2025 with a 9.3 severity. The sentence to sit with is the last one: a check that a policy exists is not a check that the policy is right, and it reads green either way.
