PT-2026-36161 · Chartbrew · Chartbrew

Larlarua · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-40600

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew version 4.9.0

Description Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record belonging to a different project. The application authorizes the caller based on the project in the URL path but fails to verify if the policy id belongs to that specific project. This enables cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings.

Recommendations Update to version 5.0.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-40600

Affected Products

Chartbrew

References · 7

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-pq8h-2h99-39xm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40600 · Security Note
• https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 · Note
• https://twitter.com/infoflowcloud/status/2049940917923049636 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049949187437977709 · Twitter Post
• https://t.me/CVEtracker/52346 · Telegram Post
• https://twitter.com/CVEnew/status/2049939546268479577 · Twitter Post