Medium severity · published Oct 11, 2026
CVE-2026-108747
Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
lightdash · Lightdash
through 2.556.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-108747
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-108747
third-party-advisory
https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011
technical-description
https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134
technical-description
https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162
product
https://github.com/lightdash/lightdash
third-party-advisory
https://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion
More from lightdash
8.3
CVE-2026-61654
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
8.3
CVE-2026-61576
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
7.5
CVE-2023-35844
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow
7.3
CVE-2024-6586
Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards
6.4
CVE-2026-72846
Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery