This vulnerability (CVE-2026-12715) in Google Cloud Firebase Studio involved missing authorization checks in the GetSignedGcsUrl RPC, which allowed authenticated users to list buckets and download deployment source code belonging to other tenants. The flaw enabled unauthorized access to sensitive data through improperly authorized Google Cloud Storage URL signing requests. The vulnerability was patched by Google on April 15, 2026, with the fix deployed server-side in the cloud service. No active exploitation has been reported, and Google manages remediation for this cloud-hosted service.

An attacker with authentication could access and download source code deployed by other users, potentially exposing sensitive data such as API keys stored within Firebase Studio workspaces. This unauthorized access could lead to information disclosure and compromise of tenant data confidentiality. The CVSS 4.0 base score is 8.5, indicating a high severity impact with network attack vector, low attack complexity, no privileges required beyond authentication, and high impact on confidentiality and security requirements.

Google has already deployed the fix to the backend service as of April 15, 2026. No customer action is required to mitigate this vulnerability. As a precaution, users who stored sensitive information like API keys in their Firebase Studio workspace may choose to rotate those keys. Since this is a cloud service, Google manages remediation transparently.