Insufficient Database Security in Lovable by Lovable Inc.

CVE-2025-48757

What is CVE-2025-48757?

An insufficient database Row-Level Security policy in Lovable allows remote unauthenticated attackers to gain unauthorized access to sensitive data. This vulnerability permits attackers to read or write to arbitrary database tables associated with any generated sites, potentially leading to significant data breaches and compromise of confidential information. Immediate measures must be taken to address this security flaw to protect user data and maintain the integrity of systems utilizing Lovable.

References