Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)

How it was found

Summary:

An account with the Editor role can successfully call the API endpoint /workspaces/<WORKSPACE_ID>/tool-preferences/supabase/enable that disables workspace-wide admin-only features (Lovable Cloud). The API does not enforce server-side role checks for this action, allowing a vertical privilege escalation (Broken Access Control).

Steps To Reproduce:

Preconditions

• Two accounts are members of the same workspace Victim-Workspace:

  • Account A (Owner/Admin) - Owner role in Victim-Workspace.
  • Account B (Editor) - Editor role in the same Victim-Workspace.

1. Sign in as Account A (Admin) and toggle the Cloud feature off inside the workspace.

2. Capture this endpoint (Responsible for Disabling Cloud Feature).

POST /workspaces/<WORKSPACE_ID>/tool-preferences/supabase/enable HTTP/2
Host: lovable-api.com
Authorization: Bearer <OWNER-JWT>
Content-Type: application/json


{"approval_preference":"disable"}

Note: <WORKSPACE_ID> is the workspace id for Victim-Workspace.

4. Modify request to use Editor JWT Token

• Replace the Authorization header with Account B (Editor) JWT:

POST /workspaces/<WORKSPACE_ID>/tool-preferences/supabase/enable HTTP/2
Host: lovable-api.com
Authorization: Bearer <EDITOR_JWT>
Content-Type: application/json

{"approval_preference":"disable"}

5. When the request is sent again with the Editor's JWT , the request succeeds and the Lovable Cloud setting is switched off for the workspace.

Proof of Concept :

{F4859059}

Impact

An Editor can disable the Lovable Cloud feature, which powers the workspace’s backend as mentioned in documentation (database, auth, storage, and serverless functions). This can lead to workspace-wide downtime and broken functionality for all projects and users, making the impact High due to the potential service disruption and business damage.