CVE-2026-121631

MEDIUM 4.2

Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.

CWE	CWE-639
Vendor	lightdash
Product	lightdash
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for lightdash lightdash

Be the first to know when new medium vulnerabilities affecting lightdash lightdash are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

lightdash / lightdash

0.2609.0 < 3.137.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6 github.com: https://github.com/lightdash/lightdash/releases/tag/3.137.0 vulncheck.com: https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints

Credits

DAFFIER