Priority HIGH 69
Lightdash is an open source business intelligence platform.
lightdash
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
lightdash records in CISA KEVNo lightdash vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2024-06108 CVE-2024-6586
Lightdash version 0.1024.6 allows users with the necessary permissions, such as…
Priority HIGH 67
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards.
TI-2024-06107 CVE-2024-6585
Cross-site scripting in Lightdash
Priority MEDIUM 58
Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scrip…
TI-2026-51071 CVE-2026-72846 · GHSA-hw2h-qf3m-2r8v
Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery
Priority MEDIUM 57
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams…
TI-2023-17919 CVE-2023-35844 · GHSA-x8qg-5w28-wmr9
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints…
Priority MEDIUM 48
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow ..
TI-2026-82768 CVE-2026-61576
Path traversal in Lightdash dbt Cloud webhook allows unauthenticated requests
Priority LOW 36
Lightdash is an open source business intelligence platform.
TI-2026-84445 CVE-2026-121631 · GHSA-mq8q-r5x2-4283
Cross-project authorization bypass in Lightdash RenameService
Priority LOW 11
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belongin…
TI-2026-70725 CVE-2026-108747 · GHSA-7xvq-pcf6-2w3w
Authorization bypass in Lightdash lets users delete other users' tokens
Priority LOW 11
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID.