PT-2026-32028 · Chartbrew · Chartbrew

Kakeru-Ishii · Published 2026-04-10 · Updated 2026-04-10 · CVE-2026-32252

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 4.9.0

Description Chartbrew is a web application that connects to databases and APIs to create charts. A cross-tenant authorization bypass exists in the GET /team/:team id/template/generate/:project id endpoint. The handler calls checkAccess(req, "updateAny", "chart") without awaiting the promise, and it does not verify that the supplied project id belongs to the requesting team. This allows an authenticated attacker with template-generation permissions in their own team to request template data for a project belonging to another team and receive victim project data.

Recommendations Update to version 4.9.0 or later.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-32252

Affected Products

Chartbrew

References · 5

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mw4f-cf22-qpcj · Exploit
• https://github.com/chartbrew/chartbrew/commit/bf5919043d3587fcbe76123aaabd9a0a9d1033f1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-32252 · Security Note
• https://twitter.com/VulmonFeeds/status/2042733328772558958 · Twitter Post
• https://twitter.com/CVEnew/status/2042710185731310073 · Twitter Post