Read the docs
TI-2026-84445 Aliases CVE-2026-121631GHSA-mq8q-r5x2-4283

Cross-project authorization bypass in Lightdash RenameService

Priority LOW 11CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Lightdash versions from 0.2609.0 before 3.137.0 contain an authorization bypass in the RenameService that lets an authenticated user with update Project permission on one project access dashboards in other projects. The service does not verify that the projectUuid in the URL matches the target dashboard's project (CWE-639). An attacker with low privileges can modify foreign dashboard filters and break charts through crafted POST requests to the rename dashboard endpoint, or read field metadata from projects they cannot access through GET requests to the fields endpoint.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.

Why it matters now

EPSS 0.00178 7th percentileScored 2026-11-07
Fix Fixed lightdash (lightdash): 3.137.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
lightdashlightdash0.2609.0 to before 3.137.03.137.0Patch availableCNA
  • lightdash Vendorlightdash Affected 0.2609.0 to before 3.137.0 Fixed in 3.137.0 Patch available CNA

Remediation

Upgrade Lightdash to version 3.137.0. The sources list no fixed version for any other Lightdash release.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA lightdash (lightdash) Fixed in 3.137.0

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121631
  2. 2026-11-03 Alias added: GHSA-mq8q-r5x2-4283

References

Patch 1

Advisory 1

  • TI-2026-82775 Unauthenticated dbt Cloud webhook in Lightdash allows path injection CVSS 4.0HIGH 8.3
  • TI-2024-06108 Lightdash version 0.1024.6 allows users with the necessary permissions, such as… CVSS 3.1HIGH 7.3
  • TI-2024-06107 Cross-site scripting in Lightdash CVSS 3.1MEDIUM 5.4
  • TI-2026-51071 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery CVSS 4.0MEDIUM 5.3
  • TI-2023-17919 packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints… CVSS 3.1HIGH 7.5
  • TI-2026-82768 Path traversal in Lightdash dbt Cloud webhook allows unauthenticated requests CVSS 4.0HIGH 8.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences