Auth bypass in Lightdash
CVE-2026-108747
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011 (third-party-advisory)
- github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/pa… (technical-description)
- github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/pa… (technical-description)
- github.com/lightdash/lightdash (product)
- www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-108747?
- CVE-2026-108747 is a medium-severity vulnerability in Lightdash, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.2/10. Published 2026-10-11.
- How severe is CVE-2026-108747?
- Medium severity. CVSS v3 base score is 4.2 out of 10.