CVE-2026-40600
HighSummary
In version 4.9.0 of Chartbrew, authenticated users with access to one project can update or delete a SharePolicy record belonging to another project. The issue arises from the lack of verification that policy_id belongs to the specified project.
Risk Assessment
The ability to modify dashboard sharing rules across projects poses a risk of unauthorized data access and user privacy violations.
Recommendation
It is recommended to upgrade to version 5.0.0, where the issue has been patched to prevent unauthorized modifications of sharing rules.
Other vulnerabilities in Chartbrew
See all- CVE-2026-40904High
In version 4.9.0 of Chartbrew, a vulnerability allows low-privileged attackers to access data from other projects within the same team. This vulnerability enables reading, executing, creating, updating, and deleting datasets and data requests that the attacker should not have access to.
- CVE-2026-40601High
In version 4.9.0 of Chartbrew, a vulnerability exists that allows access to the POST /api/chart/:chart_id/query endpoint without authentication. An attacker who knows the chart identifier can trigger a data refresh and access private charts.
- CVE-2026-40595High
In version 4.9.0 of Chartbrew, there is a vulnerability that allows public access to chart data, even if they are hidden. This issue arises from improper verification of access permissions for charts in public projects.
Original NVD description (English source)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0.