Executive brief
Google Cloud Firebase Studio, a tool used for developing and managing Firebase applications, contained a security flaw that could allow unauthorized access to private data. An attacker with a standard account could have downloaded the source code of other users' applications and accessed sensitive information stored in their cloud storage buckets. Google has already applied a fix to their systems, so no customer action is required, though users are advised to rotate any sensitive API keys previously stored in the environment as a precaution.
Technical details
A missing authorization vulnerability (CWE-862) existed in the GetSignedGcsUrl RPC within Google Cloud Firebase Studio. An authenticated attacker could exploit this flaw to list storage buckets belonging to other tenants and generate signed URLs to download deployed source code and other sensitive assets. The root cause was a failure to properly validate that the requesting user had the necessary permissions for the target tenant's resources. Google has patched the backend service as of April 15, 2026, and recommends that users rotate sensitive credentials like GEMINI_API_KEY if they were stored within the Firebase Studio workspace.
Affected products
- Google Cloud Firebase Studio prior to 2026-04-15
Timeline
- 2026-04-15: patched: Fix deployed to backend services
- 2026-06-24: advisory: Google Cloud security bulletin published
- 2026-07-17: disclosed: CVE record published to NVD