CVE-2025-48757: Lovable

Critical severity, CVSS 9.3. EPSS: 0.8% chance of exploitation in the next 30 days.

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. NOTE: this is disputed by the Supplier because each individual customer of the Lovable platform accepts a responsibility over protecting the data of their application.

Affected products

• Lovable Lovable: up to and including 2025-04-15

Published 2025-05-30. Last modified 2026-06-17.