CVE-2026-108747
MediumCVSS 4.2Summary
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Risk Assessment
An attacker can remotely revoke other users' access tokens, disrupting API integrations and organizational operations. The risk also includes targeted sabotage against specific users.
Recommendation
Update Lightdash to a version later than 2.556.0 if available, and implement additional authorization checks for token operations. Monitor logs for unauthorized DELETE requests to token routes.
Other vulnerabilities in Lightdash
See all- CVE-2023-35844High
Lightdash versions before 0.510.3 have insecure file endpoints that allow directory traversal and do not ensure that an intended file extension (.csv or .png) is used.
- CVE-2026-72846Medium
Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.
Original NVD description (English source)
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS