Missing Authorization in Google Cloud Firebase Studio by Google
CVE-2026-12715

8.5HIGH

Key Information:

Vendor: Google Cloud
Status: Firebase Studio
Vendor: CVE Published:; 17 July 2026

🔔 Create Google Cloud Vulnerability Alert

What is CVE-2026-12715?

A missing authorization vulnerability in Google Cloud Firebase Studio allows attackers to gain unauthorized access to deployed source code and sensitive data through unauthorized Google Cloud Storage (GCS) URL signing requests. This issue affects versions released prior to April 15, 2026, and has since been addressed by a patch, ensuring that users no longer need to take any action regarding this vulnerability.

Affected Version(s)

Firebase Studio 0 < 2026-04-15

References

https://docs.cloud.google.com/support/bulletins#gcp-2026-043

CVSS V4

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 17, 2026
Vulnerability Reserved
Jun 19, 2026

Credit

A Security Researcher

CVE-2026-12715 Data

JSON