CVE-2026-121631 — Vulnerability intelligence
—
Published:
- CVSS
- 2.3
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.