CVE-2026-121631 Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...

CVE-2026-121631

Lightdash versions 0.2609.0 before 3.137.0 are vulnerable to an authorization bypass in the RenameService . This flaw stems from a failure to verify that the projectUuid provided in the URL matches the projectUuid of the target dashboard. Authenticated users with update Project permissions on one...

EUVD-2026-116098

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...