This vulnerability is an Insecure Direct Object Reference that allows authenticated users to supply arbitrary UUID values to several tRPC API procedures—including project.get, member.remove, and chat.conversation.delete. The missing object‑level authorization check lets an attacker, and conversation history. Classified as CWE‑639, the impact undermines confidentiality, integrity, and availability of user data and can be leveraged to exfiltrate or destroy other users’ resources.

The bug is present in all releases of the Onlook application up to and including version 0.2.32, encompassing the onlook:repo product. Any deployment that has not applied the fix in commit 423e2e924366419e418ee049093872d535eea41a remains vulnerable.

With a CVSS score of 8.7, the issue is high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, implying no known wild exploits yet; however, the requirement for an authenticated credential reduces the barrier to exploitation. Once authenticated, an attacker can send crafted API requests with forged UUIDs to the vulnerable endpoints and read or delete the resources of other users.