Lovable AI App Builder Hit by Reported API Flaw Exposing Thousands of Projects

Gbhackers •Divya • April 21, 2026

The popular AI application builder, Lovable, is currently facing a massive data breach due to an unpatched API vulnerability. Security researchers have revealed that a critical flaw exposes sensitive project data, source code, and user credentials for any project created on the platform before November 2025. According to a detailed public disclosure by security researcher […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

API Flaw in Lovable AI App Builder Exposes Sensitive Data of Thousands A critical Broken Object Level Authorization (BOLA) vulnerability in Lovable, an AI-powered app builder, has been reported, allowing unauthorized access to sensitive project data. This flaw affects thousands of projects created before November 2025, exposing source code, database credentials, AI chat histories, and real customer information. Security researchers have disclosed that the unpatched API vulnerability poses a significant risk to users of the platform. The breach highlights the importance of securing API endpoints to prevent unauthorized data access. Users are urged to review their project security and data exposure. The current status indicates that the vulnerability remains unpatched, raising concerns about the potential for exploitation. Affected users include developers and businesses relying on Lovable for app development. The incident underscores the need for immediate action to secure sensitive information. 2 sources 66

Extracted Entities

Lovable AI App Builder Hit by Reported API Flaw Exposing Thousands of Projects

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)