CVE-2026-121631

    Dashboard / Vulnerabilities / CVE-2026-121631

    CVE-2026-121631

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

    Details: Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121631.json, https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6, https://nvd.nist.gov/vuln/detail/CVE-2026-121631, https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints, https://github.com/lightdash/lightdash/releases/tag/3.137.0, https://github.com/lightdash/lightdash

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 3dd645304292d48d04693426feaacc5128f1a739
    Fixed -49fc18068067fdc7741ddd771722be38306ce0a2

    Affected versions

    3.135.2
    3.135.1
    3.135.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-121631 | CVE-DB