PT-2026-23635 · Chartbrew · Chartbrew

Ytlamal · Published 2026-03-06 · Updated 2026-03-14 · CVE-2026-25877

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.1

Description Chartbrew is a web application that connects to databases and APIs to create charts. Before version 4.8.1, authorization checks for chart operations (update, delete, etc.) relied only on the project id parameter. The chart id was not validated, allowing authenticated users with project access to manipulate charts belonging to other users or projects. The application uses the /api/chart endpoint for chart-related operations.

Recommendations Update to version 4.8.1 or later.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2026-25877

GHSA-9FCR-X8X8-MRXC

Affected Products

Chartbrew

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25877.json · Exploit
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fcr-x8x8-mrxc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25877 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.1 · Note
• https://t.me/cveNotify/154459 · Telegram Post
• https://t.me/cveNotify/154903 · Telegram Post
• https://twitter.com/dailycve/status/2031395195380465965 · Twitter Post
• https://twitter.com/Tlam56211480/status/2032729936331743489 · Twitter Post