Low-privileged user can enable or disable Lovable AI for new projects in workspace

How it was found

Hello team, I hope this report finds you well.

On lovable.dev, low-privileged user can enable or disable Lovable AI for new projects in workspace. During testing, I found improper authorization vulnerability that allows low privileged user to modify Lovable AI settings. Here's the steps to reproduce.

Steps To Reproduce:

1. Get the endpoint to enable and disable Lovable AI for new projects in your own workspace
2. Now, replay that endpoint on another workspace with low-privileged role

<!-- To enable -->
DELETE /workspaces/<workspace_id>/tool-preferences/ai_gateway/enable

<!-- To disable -->
POST /workspaces/<workspace_id>/tool-preferences/ai_gateway/enable
{
"approval_preference":"disable"
}

I have provided a video POC to demonstrate this.

Video PoC

{F4854546}

For log review:

X-Hackerone-Research: anxioussick

Impact

Unauthorized enable or disable Lovable AI for new projects in workspace