CVE-2026-108747: Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Lightdash organization member can exploit it. The attacker needs the UUID of the personal access token they want to revoke; the affected deletion request can target tokens belonging to users in other organizations.
What is the practical impact of exploitation?
An attacker can revoke another user's personal access token, causing API integrations or other automation that relies on that token to stop working. The provided data indicates integrity and availability impact, not confidentiality impact.
Are deployments through version 2.556.0 affected by default?
The issue is reported in Lightdash through 2.556.0 and affects the personal-access-token deletion route. The provided data does not identify a configuration setting that must be enabled or disabled for the authorization check to fail.
How can administrators tell whether they may have been affected?
Review deletion activity and API-integration failures for personal access tokens that were revoked unexpectedly. In particular, investigate token deletions initiated by organization members who did not own the deleted token, including tokens associated with other organizations.