Auth bypass in Lightdash
CVE-2026-121631
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
Vulnerability class: IDOR (Insecure Direct Object Reference)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/lightdash/lightdash/releases/tag/3.137.0 (issue-tracking, patch)
- github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6 (vendor-advisory, technical-description)
- www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameserv… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-121631?
- CVE-2026-121631 is a medium-severity vulnerability in Lightdash, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.2/10. Published 2026-11-03.
- How severe is CVE-2026-121631?
- Medium severity. CVSS v3 base score is 4.2 out of 10.