PT-2026-23639 · Chartbrew · Chartbrew

Highrazvanilin · CVE-2026-27603 · Published 2026-03-06 · Updated 2026-03-11

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.8.4

Description Chartbrew is a web application that connects to databases and APIs to create charts. Prior to version 4.8.4, the chart filter endpoint, ''/project/:project id/chart/:chart id/filter'', lacks both verifyToken and checkPermissions middleware. This allows unauthenticated users to access chart data from any team or project. The project id and chart id are vulnerable parameters.

Recommendations Update to version 4.8.4 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-27603

GHSA-9FHR-5VVC-P455

Affected Products

Chartbrew

References · 10

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fhr-5vvc-p455 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27603.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27603 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27603 · Vendor Advisory
• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4 · Note
• https://twitter.com/cracbot/status/2031686831981605228 · Twitter Post
• https://twitter.com/dailycve/status/2031395632162680975 · Twitter Post
• https://t.me/cveNotify/154907 · Telegram Post
• https://t.me/cveNotify/154463 · Telegram Post
• https://t.me/CVEtracker/46538 · Telegram Post