VBS-2026-0018CRITICALCVSS 9CWE-863A disputed CVE class describing insufficient Supabase RLS in generated apps that could allow unauthenticated reads/writes when policies were missing.
Enforce RLS-by-default and block deploys that lack strict table policies.
How do I check if my Supabase generated schemas + Missing RLS policies app is affected by lovable generated app authorization gap (CVE-2025-48757, disputed)?
A disputed CVE class describing insufficient Supabase RLS in generated apps that could allow unauthenticated reads/writes when policies were missing.. Search your codebase for Supabase generated schemas, Missing RLS policies patterns and verify the remediation has been applied. This is rated CVSS 9 — treat it as a live incident if your app is already in production.
Why does Lovable generate code with CWE-863 (critical severity)?
A disputed CVE class describing insufficient Supabase RLS in generated apps that could allow unauthenticated reads/writes when policies were missing.
How do I fix lovable generated app authorization gap (CVE-2025-48757, disputed)?
Enforce RLS-by-default and block deploys that lack strict table policies.
What is CVE-2025-48757 and how does it affect Lovable projects?
CVE-2025-48757 is a critical severity CVE with a CVSS score of 9, affecting Lovable. A disputed CVE class describing insufficient Supabase RLS in generated apps that could allow unauthenticated reads/writes when policies were missing..