Authorization Bypass Vulnerability in Lightdash by Lightdash
CVE-2026-121631

2.3LOW

Key Information:

Vendor

Lightdash

Status
Lightdash
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121631?

Lightdash versions prior to 3.137.0 are affected by an authorization bypass vulnerability in the RenameService component. This flaw allows authenticated users with update Project permissions on one project to access and alter dashboards associated with different projects. The issue arises due to inadequate validation of the project UUID in requests. Attackers can exploit this vulnerability by forging POST requests to the rename/dashboard endpoint, tampering with dashboard filters, or send GET requests to the rename/dashboard/fields endpoint to extract field metadata from unauthorized projects.

Affected Version(s)

lightdash 0.2609.0 < 3.137.0

References

https://github.com/lightdash/lightdash/security/advisorie...
vendor-advisorytechnical-description
https://github.com/lightdash/lightdash/releases/tag/3.137.0
patchissue-tracking
https://www.vulncheck.com/advisories/lightdash-before-cro...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

DAFFIER
.