CVE-2026-108747
Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion
CVSS Score
4.2
EPSS Score
0.0%
EPSS Percentile
0th
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
| CWE | CWE-639 |
| Vendor | lightdash |
| Product | lightdash |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for lightdash lightdash
Be the first to know when new medium vulnerabilities affecting lightdash lightdash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
Lightdash / lightdash
0 ≤ 2.556.0
References
hackmd.io: https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011 github.com: https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134 github.com: https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162 github.com: https://github.com/lightdash/lightdash vulncheck.com: https://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion
Credits
HaiND from the Post and Telecommunication Institute of Technology