By It is affected if any Supabase table it uses has Row Level Security turned off, or a policy that lets anyone read or change rows. The CVE covers Lovable apps built through April 15, 2025, but the cause is a database setting, not a Lovable version, so check your tables whenever your app was built.
What CVE-2025-48757 is
The US National Vulnerability Database describes it as "an insufficient database Row-Level Security policy in Lovable through 2025-04-15" that "allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites." It was published on May 29, 2025, and is marked as disputed by Lovable.
The researcher who reported it, Matt Palmer, analyzed 1,645 Lovable projects and found 303 exposed endpoints in 170 of them, about 1 in 10. On one site, the full user table was readable, including the emails of more than 500 people.
Why it happens
A Lovable app's browser code talks to Supabase directly with a public key. That is normal. What protects the data is Row Level Security: rules in the database that decide which rows each user may read or change. When a table has it turned off, or has a policy that allows everyone, the public key opens the whole table.
How to check your app
- In the Supabase dashboard, open the Table Editor and look for tables without Row Level Security. The Security Advisor lists them too.
- Read each policy.
using (true), or a rule that only checks whether someone is signed in, lets every user see every row. - Test from outside, on your own project only: request a table that should be private with just the public key your app uses. If rows come back, they are exposed.
curl "https://YOUR-PROJECT.supabase.co/rest/v1/YOUR_TABLE?select=*" \
-H "apikey: YOUR_PUBLIC_KEY"If your tables were open
- Turn on Row Level Security and add policies before anything else. The Supabase guide has an example policy.
- Check the Supabase logs for requests you don't recognize, and export them while they still exist.
- If personal data could have been read, follow the first 24 hours after a leak.
Top-rated companies for Lovable apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Questions
How do I check my Lovable app for CVE-2025-48757?
Open the Supabase dashboard and confirm Row Level Security is on for every table, then request a table that should be private using only the public key. If rows come back, they are exposed.
Does Lovable accept CVE-2025-48757?
No. The NVD entry is marked as disputed: Lovable says each customer is responsible for protecting their own app's data. The database check is the same either way.
Sources: NVD, CVE-2025-48757; Matt Palmer, statement on CVE-2025-48757.