CVE-2025-63783: 
Homebrew vulnerability analysis and mitigation

CVE-2025-63783 is a Broken Object Level Authorization (BOLA) vulnerability — also known as Insecure Direct Object Reference (IDOR) — in the tRPC project mutation APIs of the Onlook web application version 0.2.32. The flaw allows authenticated attackers to modify, delete, or manipulate tags on projects belonging to other users by supplying an arbitrary project ID in API requests. It was published on November 7, 2025, and carries a CVSS v3.1 base score of 7.6 (High) (RedHat CVE, Feedly).

The root cause is classified as CWE-20 (Improper Input Validation), manifesting as a failure to enforce object-level authorization in the tRPC mutation API endpoints (update, delete, add/remove tag). The API accepts a caller-supplied project ID without verifying that the authenticated user owns or is a member of the referenced project, a classic BOLA/IDOR pattern. An attacker with a valid session can enumerate or guess project IDs and send crafted tRPC mutation requests targeting those IDs over the network with no additional privileges or user interaction required. A public technical write-up and proof-of-concept are available (Researcher Blog, Notion Write-up).

A successful exploit allows an authenticated attacker to unlawfully update or delete any other user's project, as well as add or remove tags on those projects, without any ownership relationship. This results in significant integrity and availability impacts — project data can be corrupted or permanently destroyed — while also exposing limited confidentiality information through object ID enumeration. The CVSS v3.1 scoring reflects high availability impact, low integrity impact, and low confidentiality impact (RedHat CVE, Feedly).

A proof-of-concept exploit is publicly available on the researcher's blog, demonstrating the IDOR attack against Onlook 0.2.32 tRPC mutation endpoints. There is no confirmed evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of widespread exploitation (Feedly).

1. Authentication: Obtain a valid user account on the target Onlook instance (version 0.2.32). No elevated privileges are required.
2. Reconnaissance: Identify valid project IDs belonging to other users through enumeration (e.g., sequential or UUID-based IDs observed in normal application traffic or API responses).
3. Craft malicious tRPC request: Construct a tRPC mutation API request (update, delete, or add/remove tag) substituting the target victim's project ID in place of the attacker's own project ID.
4. Send request: Transmit the crafted request to the Onlook tRPC API endpoint over the network. No user interaction from the victim is required.
5. Achieve unauthorized action: The server processes the mutation without verifying ownership, resulting in unauthorized modification, deletion, or tag manipulation of the victim's project (Researcher Blog, Notion Write-up).

• Network: Unusual tRPC mutation API requests (update, delete, add/remove tag) originating from authenticated users referencing project IDs that do not belong to their account; high volume of mutation requests across many different project IDs from a single user session.
• Logs: Application logs showing mutation operations on projects by users with no ownership or membership relationship to those projects; repeated API calls with varying project IDs from the same authenticated session.
• Application Behavior: Unexpected project deletions or modifications reported by users who did not initiate changes; unexplained tag additions or removals on projects.

No official patch has been confirmed for Onlook 0.2.32 at the time of publication. As an immediate mitigation, operators should implement server-side object-level authorization checks in all tRPC mutation handlers to verify that the authenticated user owns or is a member of the requested project before processing any update, delete, or tag operation. Additional recommended controls include implementing role-based access controls (RBAC), adding audit logging for all project mutation activities, and monitoring for anomalous cross-user API access patterns (RedHat CVE, Feedly).