CVE-2026-108747 Details

A vulnerability allowing authorization bypass in personal access token deletion has been identified in Lightdash versions through 2.556.0. This issue enables authenticated organization members to delete other users' personal access tokens by UUID, regardless of ownership or organization affiliation. The vulnerability arises because the deletion route authorizes with an empty-conditions ability rule, allowing any member with personal access token permissions to revoke tokens from others, disrupting their API integrations.

The vulnerability can be addressed by modifying the deletion service to include an ownership check, similar to the existing rotation function. This ensures that a user can only delete their own tokens. Additionally, the ability rule should be updated to accurately reflect ownership conditions.