One lunch break to read every user's data. here's how.

What CVE-2025-48757 actually is

How the attack works

1. 1

   Open any Lovable app and look at the network tab. The Supabase URL and anon key are right there in the requests — they have to be, for the app to work.

2. 2

   Copy the key and send your own query straight to the Supabase REST API, skipping the app's UI entirely.

3. 3

   If RLS is off on a table, the API returns every row. Change the query and you can read full user lists, payment records, phone numbers, and even other services' API keys.

4. 4

   Because writes go through the same path, an attacker can also insert or modify data — no login, no exploit code, no special skill.

How big was it

Figures from security researcher Matt Palmer, who crawled 1,645 Lovable-powered projects in May 2025. The exposed data included names, phone numbers, subscriptions, payment details, and live API keys (Google Maps tokens and more).

How to fix it

Enable RLS on every table, then write a policy that scopes rows to the logged-in user. In the Supabase SQL editor:

-- 1. Turn on Row Level Security
alter table public.profiles enable row level security;

-- 2. Only let users read their own rows
create policy "Users read own profile"
on public.profiles
for select
using ( (select auth.uid()) = user_id );

-- Repeat for every table. Wrapping auth.uid() in a
-- subselect — (select auth.uid()) — keeps it fast at scale.

FAQ