PT-2026-32028 · Chartbrew · Chartbrew

Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-32252

Mitre

CVSS v3.1

7.7

High

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team id/template/generate/:project id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project id belongs to req.params.team id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-32252

Affected Products

Chartbrew

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-32252 · Security Note
• https://github.com/chartbrew/chartbrew/commit/bf5919043d3587fcbe76123aaabd9a0a9d1033f1 · Note
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mw4f-cf22-qpcj · Note