CVE-2026-121631: Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lightdashto a version that resolves this vulnerability.Fixed in 3.137.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be authenticated and have update Project permission on at least one Lightdash project. They can then target dashboards in a different project even if they do not have access to that project.
What access can an attacker gain or affect?
Crafted GET requests to the rename/dashboard/fields endpoint can disclose field metadata from unauthorized projects. Crafted POST requests to the rename/dashboard endpoint can modify filters on foreign dashboards and break charts.
Are all affected Lightdash versions vulnerable?
The affected range is Lightdash 0.2609.0 through versions before 3.137.0. Version 3.137.0 is identified as the release containing the fix.
What request condition triggers the authorization bypass?
The issue occurs because the RenameService does not verify that the projectUuid in the URL matches the projectUuid of the dashboard being targeted. An attacker can use a crafted request that supplies a project UUID they can update while referencing a dashboard from another project.