PT-2026-36164 · Chartbrew · Chartbrew

Larlarua · CVE-2026-40904 · Published 2026-04-30 · Updated 2026-04-30

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.0.0

Description Chartbrew exposes multiple 'dataset' and 'dataRequest' endpoints that authorize low-privileged project members at the team level. The system fails to bind the requested dataset id, dataRequest id, and connection id to the projects allowed for the caller. This allows an authenticated attacker with access to a single project within a team to read, execute, create, update, and delete datasets and data requests belonging to other projects in the same team. This leads to cross-project data disclosure and unauthorized use of database or API connections.

Recommendations Update to version 5.0.0.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-40904

GHSA-JQ95-GQWW-VHM3

Affected Products

Chartbrew

References · 8

• 🔥 https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jq95-gqww-vhm3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40904.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40904 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40904 · Vendor Advisory
• https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 · Note
• https://twitter.com/CVEnew/status/2049939548860448835 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049940953348087950 · Twitter Post
• https://t.me/CVEtracker/52349 · Telegram Post