Chartbrew CVE-2026-35514

The endpoint POST /user/invited must be network-accessible on the Chartbrew instance. No special configuration or prerequisites are required on the attacker side - the vulnerability is triggered by any HTTP POST request to the endpoint, with no authentication header, session cookie, or valid invite token needed. The vulnerability is NOT conditional on signupRestricted being enabled, though the impact is most severe in that configuration because it bypasses the intended access restriction. Versions 4.9.0 and earlier are vulnerable; version 5.0.0 and later are patched. Default Chartbrew deployments do not require special flags or optional features to be vulnerable - the /user/invited endpoint is present in all standard installations.

This vulnerability presents moderate-to-high real-world risk despite the CVSS 6.5 score. The attack vector is network-accessible with low complexity and no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N), meaning it is trivially exploitable by any unauthenticated attacker. The impact is primarily confidentiality and integrity loss (C:L/I:L), achieved through gaining an authenticated account in a system that explicitly restricts signup. The scope is unchanged (S:U), meaning the attacker gains user-level access, not system-wide privilege escalation. However, the real risk depends on deployment context: in a private Chartbrew instance with restricted signup, this allows complete account takeover of the application's functionality; in a public instance, it enables account creation that otherwise might be rate-limited or restricted. EPSS exploitation probability would likely be high given the endpoint is trivially discoverable and requires no complex exploitation logic. The absence of authentication or token validation means this is not merely a logic flaw but a fundamental control bypass - all modern security frameworks (SSVC, threat modeling) classify authentication bypass on account creation as critical for confidentiality of user data and integrity of access controls.

An attacker discovers a Chartbrew instance via internet scanning and observes it has signupRestricted enabled (rejecting normal registration). The attacker crafts an HTTP POST request to /user/invited with a minimal JSON body (no token required) and receives a 200 response with a valid JWT and new account credentials. The attacker then uses the JWT to authenticate to the Chartbrew API, gaining full access to dashboards, datasets, database connections, and any stored credentials or data within the application.