Chartbrew vulnerabilities

In version 4.9.0 of Chartbrew, a vulnerability allows low-privileged attackers to access data from other projects within the same team. This vulnerability enables reading, executing, creating, updating, and deleting datasets and data requests that the attacker should not have access to.

In version 4.9.0 of Chartbrew, a vulnerability exists that allows access to the POST /api/chart/:chart_id/query endpoint without authentication. An attacker who knows the chart identifier can trigger a data refresh and access private charts.

In version 4.9.0 of Chartbrew, authenticated users with access to one project can update or delete a SharePolicy record belonging to another project. The issue arises from the lack of verification that policy_id belongs to the specified project.

In version 4.9.0 of Chartbrew, there is a vulnerability that allows public access to chart data, even if they are hidden. This issue arises from improper verification of access permissions for charts in public projects.