CVE-2026-121631 Details
Description
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
An authorization bypass vulnerability has been identified in Lightdash versions 0.2609.0 prior to 3.137.0. This vulnerability allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project. The issue arises from the RenameService not verifying that the projectUuid in the URL matches that of the target dashboard. Exploitation can be done by sending crafted POST requests to the rename/dashboard endpoint, which can alter dashboard filters and disrupt chart functionality, or by sending GET requests to the rename/dashboard/fields endpoint to access field metadata from unauthorized projects.
Users can update to Lightdash version 3.137.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lightdash/lightdash/releases/tag/3.137.0 | [email protected] | Release NotesVendor |
| https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6 | [email protected] | AdvisoryTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Lightdash | >= 0.2609.0, < 3.137.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | New CVE Received | [email protected] |