CVE-2025-63783

The Onlook web application (version 0.2.32 ) is affected by a Broken Object Level Authorization (BOLA) vulnerability in its tRPC project mutation APIs (specifically the update, delete, and add/remove tag endpoints). The root cause is the API's failure to verify if an authenticated user owns or be...