Authorization bypass in Lightdash lets users delete other users' tokens
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
Lightdash through 2.556.0 contains an authorization bypass that lets authenticated organization members delete other users' personal access tokens by supplying the token UUID. An attacker can send DELETE requests to the personal-access-tokens route, even across organizations, to revoke a victim's token and break API integrations. Exploitation requires a high-complexity attack condition and low privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for lightdash.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-108747
- 2026-10-11 Alias added: GHSA-7xvq-pcf6-2w3w
- 2026-10-13 CISA SSVC decision points changed
References
Other 3
- https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134
- https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162
- https://github.com/lightdash/lightdash
More lightdash vulnerabilities
- TI-2026-82775 Unauthenticated dbt Cloud webhook in Lightdash allows path injection CVSS 4.0HIGH 8.3
- TI-2024-06108 Lightdash version 0.1024.6 allows users with the necessary permissions, such as… CVSS 3.1HIGH 7.3
- TI-2024-06107 Cross-site scripting in Lightdash CVSS 3.1MEDIUM 5.4
- TI-2026-51071 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery CVSS 4.0MEDIUM 5.3
- TI-2023-17919 packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints… CVSS 3.1HIGH 7.5
- TI-2026-82768 Path traversal in Lightdash dbt Cloud webhook allows unauthenticated requests CVSS 4.0HIGH 8.3
Sources
- CVE-2026-108747 · CVE Program
- CVE-2026-108747 · NVD
- FIRST EPSS
- GHSA-7xvq-pcf6-2w3w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences