Threats affecting pkg:github/lightdash

Lightdash versions from 0.2609.0 up to but not including 3.137.0 have an authorization bypass vulnerability in the RenameService. Authenticated users with update Project permission on one project can access and modify dashboards of other projects due to improper verification of project identifiers. This allows attackers to modify dashboard filters and break charts or read field metadata from unauthorized projects. The vulnerability is fixed in version 3.137.0.