// SECURITY
What was CVE-2025-48757, the Lovable RLS exposure?
Updated 2026-08-11 · 5 min read
CVE-2025-48757 (CVSS 9.3) was a critical exposure disclosed in 2025 where Lovable generated Supabase projects with Row-Level Security disabled by default. Because the public anon key sits in the browser, unauthenticated attackers could read and write data across 170+ live apps, dumping user lists, payment records, and API keys, without logging in.
What happened
Researchers found that Lovable-built apps were shipping Supabase schemas without enabling Row-Level Security. The public anon key embedded in every app let anyone query the database directly. Over 170 production apps were confirmed exposed.
Why it mattered
With RLS off, "log in" was optional. Anyone who opened developer tools could see the API key and read every row in every unprotected table, full user lists, payment records, and secrets included.
Are you affected?
- If you built with Lovable (or any tool on Supabase) before mid-2025 and never reviewed RLS, assume you may be.
- Open your app, press F12, and check the Network tab: if Supabase returns data before you log in, you are exposed.
- In the Supabase dashboard, look for tables flagged "RLS disabled".
The fix
Enable Row-Level Security on every table and add owner-scoped policies (see our RLS guide). Rotate any secrets that were reachable while the tables were open.
Key takeaways
- CVE-2025-48757 (CVSS 9.3) exposed 170+ Lovable apps via missing RLS.
- The public anon key made every unprotected table readable without login.
- Fix: enable RLS + owner-scoped policies on every table, and rotate exposed secrets.
Sources
Frequently asked
Is Lovable safe to use now?
Lovable is a tool; safety depends on your database rules. Whatever you build on Supabase, you must enable RLS and write correct policies, that responsibility sits with the app owner, not the builder.