An authorization bypass vulnerability in the Onlook repo allows authenticated attackers to perform unauthorized actions via user-controlled keys.

This vulnerability is an authorization bypass (CWE-639) occurring within the tRPC procedures. It requires an authenticated user to manipulate object references, effectively granting access to data or functions outside their authorized scope.

With a CVSS score of 8.8, this vulnerability presents a critical risk to data confidentiality and integrity. Authenticated attackers could potentially access, modify, or delete sensitive information within the application, leading to significant business disruption or data exposure. The ability to manipulate object references circumvents standard access controls, undermining the security posture of the platform.

Immediate Action: Update the Onlook repo to the version containing the fix implemented in commit 423e2e924366419e418ee049093872d535eea41a.

Proactive Monitoring: Review audit logs for unusual access patterns or attempts to access resources that deviate from established user roles.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect tRPC traffic for suspicious parameter patterns that might indicate attempted object reference manipulation.

Public Exploit Available: Unknown.

Security teams must prioritize the update to the remediated version to close the authorization gap. Review user privileges and ensure that all sensitive tRPC endpoints enforce strict server-side ownership checks.