By Get an engineer for this one. Needs server-side checks across routes and data.
- How serious
- Critical
- Fix it yourself?
- No, get an engineer
- Typical cost
- €99–$990 per fix, or $1,500–$15,000 for a full cleanup (prices)
- Top rated for Lovable
- Afterbuild Labs · 10.0/10
What you see. Anyone who types /admin into the address bar sees your dashboard, user list, or settings without logging in.
Why it happens
AI builders protect pages in the browser. The code checks whether the user looks like an admin and hides the menu or redirects. That is a cosmetic check. The page's code and the data it loads are still sent to anyone who asks, because the browser is under the visitor's control. The Next.js documentation says client-side UI restrictions alone are not sufficient for security, that returning null in a layout is not recommended, and that server actions and route handlers must be treated like public API endpoints and verify the user themselves.
On Lovable and Bolt the same applies through Supabase. An admin table with no row-level security policy, or a policy that only checks the user is logged in, lets every signed-in user read it. Our checklist calls this DATA-05, admin actions are checked on the server. Hidden buttons do not count, and neither does a redirect that fires after the data has already loaded.
Fix it yourself
- Log out, open a private window, and type each admin address directly. Note every page that loads or shows data.
- In Supabase, open Table Editor, pick each admin table, and read its policies. A policy whose condition is simply
truemeans anyone can read. - Ask the agent to add a
roleoris_admincolumn and policies that check it with(select auth.uid()), and to repeat the check inside every server action, route handler, and edge function. - Ask it to remove admin-only logic from the browser code and move it to the server, so the browser only receives what the user is allowed to see.
- Repeat step 1 as a normal user and as a logged-out visitor after each change.
When to get an engineer
Get an engineer now if real customers already use the app, since a visitor may already have read admin data. Tell them which pages opened without login, which builder you used, and whether you use Lovable Cloud or your own Supabase. One fix runs €99–$990, but admin leaks usually sit next to other access problems, so a cleanup and hardening pass at $1,500–$15,000 over 1–8 weeks is common. Start with what to do about a data leak.
Top-rated companies for Lovable apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
Admin actions are checked on the server
Hiding an admin button is not protection. Call the admin endpoint as a normal user and confirm it is refused.
Access rules are on for every table
In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say allow read, write: if true.
One user cannot open another user's records
Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.
Signing out really ends the session
Sign out, press Back, and refresh. You should not see private pages or data.
Questions
The admin page redirects me to login, so isn't it protected?
Not if the redirect runs in the browser. The page code and its data requests still reach the visitor first. Protection has to happen on the server and in the database policies.
Is this the same problem as the Lovable CVE?
It is a close relative. CVE-2025-48757 was about tables readable without proper row-level security. Open admin pages are the same gap seen from the screen instead of the database.
Sources: Next.js: Authentication guide; Supabase: Row Level Security; Statement on CVE-2025-48757.