PT-2026-23639 · Chartbrew · Chartbrew

Highrazvanilin · Publicado 2026-03-06 · Atualizado 2026-03-11 · CVE-2026-27603

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.4

Description Chartbrew is a web application that connects to databases and APIs to create charts. Prior to version 4.8.4, the chart filter endpoint, ''/project/:project id/chart/:chart id/filter'', lacks both verifyToken and checkPermissions middleware. This allows unauthenticated users to access chart data from any team or project. The project id and chart id are vulnerable parameters.

Recommendations Update to version 4.8.4 or later.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-27603

GHSA-9FHR-5VVC-P455

Produtos afetados

Chartbrew

Referências · 10

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fhr-5vvc-p455 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27603.json · Exploit
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4 · Nota
• https://twitter.com/cracbot/status/2031686831981605228 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-27603 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-27603 · Aviso do Fabricante
• https://twitter.com/dailycve/status/2031395632162680975 · Publicação no Twitter
• https://t.me/cveNotify/154907 · Publicação no Telegram
• https://t.me/cveNotify/154463 · Publicação no Telegram
• https://t.me/CVEtracker/46538 · Publicação no Telegram