Onlook vulnerabilities
We track 2 vulnerabilities in Onlook products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 22, 2026.
2vulnerabilities
0critical
2high
0exploited
8.2average CVSS score
Latest Onlook vulnerabilities
- 8.8 High severity
repo: Authorization Bypass Through User-Controlled Key
Onlook through 0.2.32, fixed in commit 423e2e9, contains a broken object level authorization vulnerability that allows authenticated attackers to access and manipulate other users' resources by supplying arbitrary UUID values to tRPC API procedures including p
- 7.6 High severity
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project…
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membershi