CVE-2025-48757: disputed Lovable RLS-policy vulnerability
The NVD record for CVE-2025-48757 describes insufficient row-level security in generated Lovable applications. The record also preserves Lovable's dispute that application builders, rather than the platform, own generated-app data protection.
- Platform
- Lovable
- Event date
- 2025-04-15
- Disclosure date
- 2025-05-29
- Affected layer
- Generated application database authorization
Confirmed impact
A CVE record and severity assessment exist, but the supplier disputes product attribution. This record does not claim confirmed exploitation or a verified victim impact.
Evidence classification
Confirmed product vulnerability. Authoritative vulnerability registry with an explicit supplier-dispute note; impact claims remain bounded to the published record.
Remediation and status
Application owners should enable RLS, define least-privilege policies for every exposed table/view, review grants, and test access as anonymous and authenticated roles.
Sentrail analysis
Regardless of attribution, generated database policies remain an application-owner control. This record stays disputed and separate from confirmed real-world incidents.
What builders can learn
- Enable RLS and test policy behavior before deployment.
- Treat generated schema and policy code as reviewable application code.
- Preserve vendor disputes and uncertainty in vulnerability reporting.
Update history
The CVE record was published.
The NVD record was modified and continues to show the supplier dispute.