Chartbrew CVE-2026-40601

Exploitation requires the attacker to possess or discover valid chart identifiers used in the target Chartbrew instance. Chart IDs may be UUIDs, sequential integers, or other formats depending on Chartbrew's internal design-discovery methods include intercepting legitimate user traffic, analyzing referrer logs if charts are embedded externally, brute-forcing predictable ID patterns, or extracting IDs from publicly shared reports. The vulnerability affects Chartbrew deployments where the POST /api/chart/:chart_id/query endpoint is network-accessible to untrusted clients. No authentication, credentials, or user interaction is required once a valid chart_id is known. The team.allowReportRefresh setting must be enabled (appears to be a default or common configuration based on the vulnerability description focusing on this check rather than its absence). Limiting factors: attacker must identify or enumerate valid chart identifiers; impact is limited to data confidentiality (read-only access) without ability to modify charts or underlying data sources. Deployments behind VPNs, IP allowlists, or with non-standard ports reduce external attacker surface but remain vulnerable to insider threats or lateral movement scenarios.

This vulnerability presents a HIGH confidentiality risk (CVSS 7.5) with straightforward exploitation characteristics. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-accessible exploitation requiring no privileges, low complexity, and no user interaction, with high confidentiality impact but no integrity or availability impact. The primary attack barrier is knowledge of valid chart identifiers, which may be enumerable or leaked through other channels (browser history, referrer logs, shared links). Without EPSS data, we cannot assess mass exploitation probability, but the low attack complexity and unauthenticated nature make this attractive for targeted attacks. Not present in CISA KEV indicates no confirmed widespread exploitation as of analysis date. The vulnerability is limited to data exposure (read-only) rather than system compromise, and scope is unchanged (U) meaning the vulnerable component and impacted resources are the same. Real-world risk depends heavily on the sensitivity of data visualized in Chartbrew deployments and whether chart IDs are discoverable. Organizations using Chartbrew for internal business intelligence with proprietary data face higher risk than those visualizing non-sensitive public metrics. Patch availability in 5.0.0 makes this immediately remediable for teams with update processes.

An attacker discovers or enumerates a valid chart_id through reconnaissance of public-facing Chartbrew instances, leaked URLs in documentation, or brute-force enumeration of sequential/predictable identifiers. The attacker crafts a POST request to https://target-chartbrew-instance.com/api/chart/[discovered_chart_id]/query without authentication credentials. The vulnerable endpoint processes the request, bypasses team membership and sharing policy checks, and returns the current dataset associated with the private chart, potentially exposing proprietary business metrics, customer data, or internal analytics. The attacker repeats this for multiple chart IDs to exfiltrate comprehensive business intelligence data.