What is the CVSS score of CVE-2026-32252?

CVE-2026-32252 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Chartbrew are affected by CVE-2026-32252?

Chartbrew versions before 4.9.0 contain a cross-tenant authorization bypass that allows authenticated users to access sensitive project data belonging to other organizations, including database…. A patch is available.

How to fix or mitigate CVE-2026-32252?

Within 24 hours: Identify all Chartbrew instances in production and verify current version against 4.9.0 baseline. Within 7 days: Apply vendor patch to upgrade all affected instances to version 4.9.0 or later; test in non-production environment first. Within 30 days: Conduct access logs review for the template generation endpoint (GET /team/:team_id/template/generate/:project_id) across all affected systems for the past 90 days to identify potential unauthorized cross-tenant access.

Chartbrew CVE-2026-32252

EUVD-2026-21553 HIGH

Improper Authorization (CWE-285)

2026-04-10 GitHub_M

Authentication Bypass Chartbrew

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:58 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.9.0

EUVD ID Assigned

Apr 10, 2026 - 20:15 euvd

EUVD-2026-21553

Analysis Generated

Apr 10, 2026 - 20:15 vuln.today

CVE Published

Apr 10, 2026 - 19:17 nvd

HIGH 7.7

DescriptionGitHub Advisory

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.

AnalysisAI

Cross-tenant authorization bypass in Chartbrew versions prior to 4.9.0 allows authenticated attackers to exfiltrate sensitive project data from other tenants. The vulnerability exists in the template generation endpoint (GET /team/:team_id/template/generate/:project_id), where unawaited promise execution and missing tenant validation enable attackers with valid template-generation permissions in their own team to access chart configurations, database connection details, and query structures from victim teams' projects. No public exploit identified at time of analysis. CVSS 7.7 reflects high confidentiality impact with scope change due to cross-tenant boundary violation.

Technical ContextAI

CWE-285 improper authorization stems from race condition in asynchronous access control. The checkAccess(req, "updateAny", "chart") promise executes without await keyword, causing handler to proceed before authorization completes. Missing ownership verification between project_id and team_id parameters allows arbitrary project access. Scope change (S:C) in CVSS vector reflects privilege escalation across tenant boundaries in multi-tenant architecture.

RemediationAI

Vendor-released patch: version 4.9.0. Organizations running Chartbrew must immediately upgrade to version 4.9.0 or later, which implements synchronous await on authorization checks and adds project-to-team ownership validation. The fix is available via commit bf5919043d3587fcbe76123aaabd9a0a9d1033f1. As temporary mitigation, restrict template generation permissions to trusted users only and audit access logs for suspicious cross-team project access attempts. No effective workaround exists without upgrading. Full security advisory: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mw4f-cf22-qpcj. Verify tenant isolation after patching by testing project access controls across team boundaries.