CVE-2026-108747

Description

Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.

References

https://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion

https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011

https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134

https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162

https://github.com/lightdash/lightdash

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-96912

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4