EUVD-2026-21553Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to own team account
-
DeliveryRequest /team/:team_id/template/generate/:project_id with target project_id
-
ExploitBypass authorization check via unawaited promise
-
ExecutionAccess cross-tenant template data
-
ImpactExfiltrate sensitive information from other organizations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated attacker with valid template-generation permissions in their own team on Chartbrew prior to 4.9.0 can exploit the cross-tenant authorization bypass by sending GET requests to /team/:team_id/template/generate/:project_id with an arbitrary project_id from another tenant. No victim interaction required. |
| Impact | CVSS 7.7 reflects high confidentiality impact via cross-tenant data exposure in a multi-tenant SaaS platform. Unauthenticated access is not required-only valid user credentials and template permissions within one tenant enable access to arbitrary other tenants' project data. No public exploit identified at time of analysis, but the flaw is trivial to exploit (network-accessible, low complexity). Organizations hosting or using Chartbrew versions before 4.9.0 face immediate confidentiality breach risk. |
| Exploit ScenarioDerived | Authenticated attacker with valid Chartbrew account enumerates team IDs across instances, then crafts GET requests to /team/{target_team_id}/template/generate/{target_project_id} with their own valid session token. The unvalidated project_id parameter and unawaited promise bypass authorization checks, returning victim project templates containing sensitive database or API credentials and data structure information. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 10, 2026
Cross-tenant authorization bypass in Chartbrew versions prior to 4.9.0 allows authenticated attackers to exfiltrate sensitive project data from other tenants. The vulnerability exists in the template generation endpoint (GET /team/:team_id/template/generate/:project_id), where unawaited promise execution and missing tenant validation enable attackers with valid template-generation permissions in their own team to access chart configurations, database connection details, and query structures from victim teams' projects. No public exploit identified at time of analysis. CVSS 7.7 reflects high confidentiality impact with scope change due to cross-tenant boundary violation.
RemediationAI
Vendor-released patch: version 4.9.0. Organizations running Chartbrew must immediately upgrade to version 4.9.0 or later, which implements synchronous await on authorization checks and adds project-to-team ownership validation. The fix is available via commit bf5919043d3587fcbe76123aaabd9a0a9d1033f1. As temporary mitigation, restrict template generation permissions to trusted users only and audit access logs for suspicious cross-team project access attempts. No effective workaround exists without upgrading. Full security advisory: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mw4f-cf22-qpcj. Verify tenant isolation after patching by testing project access controls across team boundaries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-285 improper authorization stems from race condition in asynchronous access control. The checkAccess(req, "updateAny", "chart") promise executes without await keyword, causing handler to proceed before authorization completes. Missing ownership verification between project_id and team_id parameters allows arbitrary project access. Scope change (S:C) in CVSS vector reflects privilege escalation across tenant boundaries in multi-tenant architecture.
Know when Chartbrew gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.
Executive ViewAI
Chartbrew versions before 4.9.0 contain a cross-tenant authorization bypass that allows authenticated users to access sensitive project data belonging to other organizations, including database credentials and query configurations. This vulnerability directly threatens data confidentiality across multi-tenant deployments and requires immediate patching to prevent lateral data exposure between customer environments.
Apply vendor patch. Until patching is complete: restrict template generation feature access to essential users only, implement network segmentation to limit Chartbrew instance accessibility, and enable comprehensive audit logging on the affected endpoint to detect anomalous cross-tenant requests.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
SQL injection in Chartbrew before 4.8.3. PoC available.
Remote code execution in Chartbrew prior to version 4.8.1 allows authenticated attackers to execute arbitrary code throu
Chartbrew versions up to 4.8.4 is affected by missing authentication for critical function (CVSS 7.5).
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut
Chartbrew versions before 4.8.1 fail to validate chart ownership during modification operations, allowing authenticated
Chartbrew versions prior to 4.8.4 allow authenticated users to upload arbitrary files by bypassing file type validation,
Authenticated users in Chartbrew 4.9.0 can modify or delete dashboard sharing policies across projects they don't own du
Horizontal privilege escalation in Chartbrew 4.9.0 allows authenticated low-privilege team members to access datasets, d
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended
Server-Side Request Forgery in Chartbrew versions prior to 4.8.5 allows authenticated users to create API data connectio
Unauthenticated remote attackers can access and refresh private chart data in Chartbrew 4.9.0 via an exposed API endpoin
Chartbrew 4.9.0 allows unauthenticated attackers to access hidden chart data via authentication bypass in public chart e
Exploit-DB