01 Record

CVE-2026-72846

Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

MediumPUBLISHEDCNA: VulnCheck

Base score5.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

02 Description

Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Published

2026-08-20 21:57Z1 DAY AGO

Last updated

2026-08-21 15:39Z9 HR AGO

Reserved

2026-08-10

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

Medium (CVSS 5.3)

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Weaknesses

SSVC decision

ExploitationpocAutomatablenoTechnical Impactpartial

Data version

5.2

Document digest

0a2dc904b7ba6abd91513fe94404483ee5e76c3e0e0c6b4c7ff069c7025e8fe9

VendorProductVersionsPlatforms

lightdashlightdash0 to < 1.146.4—