CVE-2026-61851

In version 4.9.0 of Chartbrew, a vulnerability allows low-privileged attackers to access data from other projects within the same team. This vulnerability enables reading, executing, creating, updating, and deleting datasets and data requests that the attacker should not have access to.

In version 4.9.0 of Chartbrew, a vulnerability exists that allows access to the POST /api/chart/:chart_id/query endpoint without authentication. An attacker who knows the chart identifier can trigger a data refresh and access private charts.

In version 4.9.0 of Chartbrew, authenticated users with access to one project can update or delete a SharePolicy record belonging to another project. The issue arises from the lack of verification that policy_id belongs to the specified project.

In version 4.9.0 of Chartbrew, there is a vulnerability that allows public access to chart data, even if they are hidden. This issue arises from improper verification of access permissions for charts in public projects.

Chartbrew prior to 5.2.3 contains a SQL injection vulnerability in the ClickHouse protocol because applySqlVariables() is called without the escapeBackslash option. An attacker can supply a backslash before a quote to bypass quote doubling and execute arbitrary ClickHouse SQL, potentially leading to data disclosure or, with appropriate database configuration, access to files or internal resources. Public dashboards can be exploited without authentication.

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery() implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's row_limit parameter into a SQL LIMIT clause without runtime integer validation. The read-only keyword check runs before this value is appended, so an authenticated user who can influence a model-generated non-integer row_limit can add SQL that bypasses the earlier check. Successful exploitation can execute arbitrary statements against the connected database, including reading or changing data and, where database permissions permit, accessing files or executing operating-system commands. This issue is fixed in version 5.2.2.

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl() to resolve and validate a target hostname, but request-promise performs a separate DNS resolution for the actual connection. An authenticated user who can create or test API connections and controls the target DNS name can return a public address during validation and a private address during the request, bypassing the protections implemented by server/modules/outboundTargetPolicy.js. This DNS rebinding condition can expose internal services, localhost resources, or cloud metadata endpoints. This issue is fixed in version 5.2.2.