Description

Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations.

Related CPE's

Could not find any relations

References

https://github.com/lightdash/lightdash

https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162

https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134

https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011

https://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion

Weaknesses

[email protected]

Primary
CWE-639

CVSS impact metrics

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

4.2 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-11T13:17:19.367Z

1 hour ago

Last modified

2026-10-11T13:17:19.480Z

1 hour ago