Skip to content
OpenAdvisories

Vendor

lightdash

7 known vulnerabilities.

lightdash at a glance

Last 12 months
5
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 3 vulnerabilities November 2026: 1 vulnerability
Show as table
MonthVulnerabilitiesCritical
Nov 202610
Oct 202630
Sep 202600
Aug 202610
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

lightdash 7
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 4.2
    CVE-2026-121631

    Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints

    Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the…

    lightdash lightdash
  • High 8.3
    CVE-2026-61654

    Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

    Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src…

    lightdash lightdash
  • High 8.3
    CVE-2026-61576

    Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key

    Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src…

    lightdash lightdash
  • Medium 4.2
    CVE-2026-108747

    Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion

    Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens rou…

    lightdash lightdash
  • Medium 6.4
    CVE-2026-72846

    Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

    Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected v…

    lightdash lightdash
  • High 7.3
    CVE-2024-6586

    Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and …

    lightdash lightdash
  • Medium 5.4
    CVE-2024-6585

    Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functional…

    lightdash lightdash