PT-2026-36160 · Chartbrew · Chartbrew

Larlarua · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-40595

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.0.0

Description Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and a team-level export toggle. These routes fail to verify if the target chart is allowed on the public report or if the governing SharePolicy permits public access. Consequently, an unauthenticated attacker with a chart identifier in a public project can read or export data for charts intentionally hidden from the report.

Recommendations Update to version 5.0.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-40595

Affected Products

Chartbrew

References · 7

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40595 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 · Note
• https://twitter.com/infoflowcloud/status/2049940935748780293 · Twitter Post
• https://twitter.com/CVEnew/status/2049939547140792748 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049954307156426931 · Twitter Post
• https://t.me/CVEtracker/52345 · Telegram Post