CVE-2026-108747
Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion
- State
- Published
- Severity
- 2.3 Low
- Published
- Oct 11, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 11, 2026
Description
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
lightdashLightdash |
|
References
- https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011third-party-advisory
- https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134technical-description
- https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162technical-description
- https://github.com/lightdash/lightdashproduct
- VulnCheck Advisory: Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.