CVE-2025-48757 explained (Lovable + Supabase RLS)
What the critical Lovable/Supabase RLS CVE was about, what the researcher found, and what to do on your app today.
CVE-2025-48757 (CVSS 9.3) describes insufficient Row Level Security on Lovable-generated apps, allowing unauthenticated access to database tables via the public anon key. The supplier disputes the CVE, arguing customers own their data protection — which is exactly why you should verify your own project.
The researcher's write-up reported 303 vulnerable endpoints across 170 of 1,645 analyzed Lovable projects (~10.3%), including exposed emails and other PII (statement).
What you should do
- Open Supabase Security Advisor and fix every RLS finding.
- Confirm no
service_rolekey is in the client. - Test logged-out access to your tables.
Assume this app may be affected by missing Supabase RLS (CVE-2025-48757 class issues). Enable RLS on all tables, replace any USING (true) policies on sensitive data, remove service_role from the client, and summarize remaining risks.
Related: Enable RLS · Is my Lovable app secure?
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.