A missing authorization check in Firebase Studio before April 15, 2026 allowed an attacker to trigger the generation of signed Google Cloud Storage URLs that provide direct access to other users' deployed source code. The flaw consequently permits the theft of proprietary code and the exposure of any sensitive data such as API keys that may be stored in the workspace. CWE‑862 highlights that the root cause is an improper access control mechanism allowing unauthorized access to protected resources.

Google Cloud Platform users who are currently running Firebase Studio versions released prior to April 15, 2026 are vulnerable. This includes any Firebase Studio workspace that may contain sensitive values; the issue is specific to the server‑side implementation and does not affect client‑side code directly.

The CVSS score of 8.5 indicates a high severity vulnerability. The EPSS score of less than 1 % suggests that while the probability of exploitation is low, it is not negligible and attackers could still successively invoke the vulnerable endpoint without authentication. The flaw is not listed in the CISA KEV catalog, implying that no widespread or known public exploits are currently linked to it. Attackers are likely to exploit this weakness by sending unauthenticated HTTP requests to the Firebase Studio API endpoint that triggers GCS URL signing, thereby retrieving source files from another tenant.