Lightdash through 2.556.0 Authorization Bypass via Personal Access Token Deletion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-108747 · Microsoft / collected KEV context

cve-program · CVE-2026-108747

• https://hackmd.io/@haind03/lightdash-pat-delete-ownership-bypass-20261011
• https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/services/PersonalAccessTokenService.ts#L107-L134
• https://github.com/lightdash/lightdash/blob/c890f0b982efb51f1f8d1535d4e334447cec2ed7/packages/backend/src/models/DashboardModel/PersonalAccessTokenModel.ts#L157-L162
• https://github.com/lightdash/lightdash
• https://www.vulncheck.com/advisories/lightdash-through-2.556.0-authorization-bypass-via-personal-access-token-deletion

No related operational record is retained in the current change model.