---
id: CVE-2026-121631
title: >-
  Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService
  Dashboard Endpoints
summary: >-
  Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass
  vulnerability in the RenameService that allows authenticated users with update
  Project permission on one project to access and modify dashboards belonging to
  a different …
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: lightdash
product: lightdash
affected:
  - lightdash >= 0.2609.0 < 3.137.0
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T16:02:33.019Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121631'
references:
  - url: >-
      https://github.com/lightdash/lightdash/security/advisories/GHSA-h6fw-x63x-9gr6
    label: Vendor Advisory
  - url: 'https://github.com/lightdash/lightdash/releases/tag/3.137.0'
    label: Vendor Patch
  - url: >-
      https://www.vulncheck.com/advisories/lightdash-before-cross-project-idor-via-renameservice-dashboard-endpoints
    label: >-
      VulnCheck Advisory: Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR
      via RenameService Dashboard Endpoints
tags:
  - cve.org
epss: 0.00178
epssPercentile: 0.07365
ingestedAt: '2026-11-05T21:36:00.448Z'
---

## Overview

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUuid from the URL matches the projectUuid of the target dashboard. Attackers can send crafted POST requests to the rename/dashboard endpoint to modify foreign dashboard filters and break charts, or send GET requests to the rename/dashboard/fields endpoint to read field metadata from projects they do not have access to.

## Affected

- `lightdash >= 0.2609.0 < 3.137.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.