PT-2026-36159 · Chartbrew · Chartbrew

Mean3374 · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-35514

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.0.0

Description Chartbrew is an open-source web application used to create charts by connecting to databases and APIs. The endpoint "POST /user/invited" fails to validate invite tokens, authentication headers, or sessions. This allows an unauthenticated attacker to call the endpoint directly to create a fully active account and obtain a valid JWT (JSON Web Token), which is a compact, URL-safe means of representing claims to be transferred between two parties. This process bypasses the normal registration endpoint "POST /user", which typically enforces the signupRestricted setting and requires verification by setting the account status to active: false.

Recommendations Update to version 5.0.0.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-35514

Affected Products

Chartbrew

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-35514 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 · Note
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-g47g-v5cp-j8hp · Note
• https://twitter.com/infoflowcloud/status/2049940958725152929 · Twitter Post
• https://t.me/CVEtracker/52344 · Telegram Post
• https://twitter.com/CVEnew/status/2049939547975459307 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049951747288768588 · Twitter Post