Lightdash
Monthly
Lightdash versions through 0.3213.0 expose the dbt Cloud webhook endpoint (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook) without authentication middleware or signature validation, so unauthenticated remote requests are accepted outright; an attacker who knows a project's UUID and whose target is configured as a dbt Cloud IDE project can inject path-traversal sequences into the accountId value, which is interpolated into the server-side dbt Cloud API URL that is then requested with the victim project's API key in the Authorization header, and can also force creation of preview environments. The vendor advisory frames the outcome as dbt Cloud API-key theft, but the supplied evidence does not establish that an attacker can observe the Authorization header of the outbound request, so confidentiality impact is assessed as limited while integrity impact comes from unauthorized preview creation. Version 0.3214.0 adds numeric validation of accountId/runId and HMAC verification of webhook signatures, but signatures are checked only when a webhook secret is configured - deployments without a secret continue to process unsigned webhooks. No public exploit identified at time of analysis.
Lightdash 0.2609.0 through 3.136.x contains a cross-project insecure direct object reference in RenameService that lets an authenticated user holding update permission on any single project tamper with dashboards in projects they cannot access. By pairing a projectUuid they control in the URL with a foreign dashboardUuid, an attacker can persist rewritten filters on another team's dashboard (breaking its charts for every viewer) or read that project's field metadata through the /rename/dashboard/fields endpoint. Exploitation requires a valid credential such as a Personal Access Token and prior knowledge of a non-enumerable foreign dashboard UUID, which is why the vendor's advisory and this analysis both treat it as a low-priority, monitor-level issue rather than an emergency; no confirmed public exploit code or KEV entry exists, though the vendor advisory publishes a proof-of-concept walkthrough.
Authorization bypass in Lightdash through 2.556.0 allows any authenticated organization member to delete another user's personal access token by supplying that token's UUID to the personal-access-tokens DELETE route, which performs no ownership or organization check - the deletion also succeeds across organization boundaries in multi-tenant or hosted deployments. Impact is limited to revoking the victim's token and breaking the API integrations that depend on it (a denial-of-service against integrations); there is no data disclosure, privilege escalation, or code execution. Exploitation requires an authenticated account with at least organization-member privileges and knowledge of the victim's PAT UUID, which is not practically enumerable and is the primary limiting factor; no public exploit code identified at time of analysis, though a third-party technical writeup of the flaw is referenced, and both the supplied CVSS 4.0 score (2.3) and the independently assessed CVSS 3.1 vector rate this as a low-severity issue.
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Lightdash versions through 0.3213.0 expose the dbt Cloud webhook endpoint (POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook) without authentication middleware or signature validation, so unauthenticated remote requests are accepted outright; an attacker who knows a project's UUID and whose target is configured as a dbt Cloud IDE project can inject path-traversal sequences into the accountId value, which is interpolated into the server-side dbt Cloud API URL that is then requested with the victim project's API key in the Authorization header, and can also force creation of preview environments. The vendor advisory frames the outcome as dbt Cloud API-key theft, but the supplied evidence does not establish that an attacker can observe the Authorization header of the outbound request, so confidentiality impact is assessed as limited while integrity impact comes from unauthorized preview creation. Version 0.3214.0 adds numeric validation of accountId/runId and HMAC verification of webhook signatures, but signatures are checked only when a webhook secret is configured - deployments without a secret continue to process unsigned webhooks. No public exploit identified at time of analysis.
Lightdash 0.2609.0 through 3.136.x contains a cross-project insecure direct object reference in RenameService that lets an authenticated user holding update permission on any single project tamper with dashboards in projects they cannot access. By pairing a projectUuid they control in the URL with a foreign dashboardUuid, an attacker can persist rewritten filters on another team's dashboard (breaking its charts for every viewer) or read that project's field metadata through the /rename/dashboard/fields endpoint. Exploitation requires a valid credential such as a Personal Access Token and prior knowledge of a non-enumerable foreign dashboard UUID, which is why the vendor's advisory and this analysis both treat it as a low-priority, monitor-level issue rather than an emergency; no confirmed public exploit code or KEV entry exists, though the vendor advisory publishes a proof-of-concept walkthrough.
Authorization bypass in Lightdash through 2.556.0 allows any authenticated organization member to delete another user's personal access token by supplying that token's UUID to the personal-access-tokens DELETE route, which performs no ownership or organization check - the deletion also succeeds across organization boundaries in multi-tenant or hosted deployments. Impact is limited to revoking the victim's token and breaking the API integrations that depend on it (a denial-of-service against integrations); there is no data disclosure, privilege escalation, or code execution. Exploitation requires an authenticated account with at least organization-member privileges and knowledge of the victim's PAT UUID, which is not practically enumerable and is the primary limiting factor; no public exploit code identified at time of analysis, though a third-party technical writeup of the flaw is referenced, and both the supplied CVSS 4.0 score (2.3) and the independently assessed CVSS 3.1 vector rate this as a low-severity issue.
packages/backend/src/routers in Lightdash before 0.510.3 has insecure file endpoints, e.g., they allow .. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.