CVE-2026-12715CWE-862

Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft

High · published July 17, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
27.5
In the wild
Unconfirmed
What it is

Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests.

This vulnerability was patched on 15 April 2026, and no customer action is needed.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear
EPSS
0.00351 · 27.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-17T15:09Z
EPSS history
Timeline
  • 17 JUL 15:09Z
    Missing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft
    cvelistv5