Chartbrew CVE-2026-40904

Exploitation requires the Chartbrew deployment to use the multi-project team feature with multiple projects grouped under a single team. The attacker must possess valid authenticated credentials to at least one project within the target team (PR:L indicates low-privilege project member role). The vulnerability affects default configurations of version 4.9.0 and potentially earlier 4.x releases where team-based access control is implemented. Exploitation is limited to lateral movement within the same team boundary; attackers cannot access projects in other teams. Single-project Chartbrew instances or deployments where all team members are intentionally granted full access to all team projects are not meaningfully affected by this flaw, as the security boundary matches the functional access model.

CVSS 8.1 (High) reflects network-based exploitation with low complexity requiring only low-privilege authentication and no user interaction, with high confidentiality and integrity impact. The attack vector (AV:N/AC:L/PR:L/UI:N) indicates realistic exploitation risk for multi-project Chartbrew deployments where team members are restricted to specific projects. The unchanged scope (S:U) limits blast radius to the application itself, but the high integrity impact (I:H) means attackers can modify or delete victim project data assets. Real-world risk is elevated for organizations using Chartbrew's multi-project feature with role-based access separation, as the vulnerability completely undermines project boundaries within teams. No EPSS score provided, no CISA KEV listing suggests exploitation has not been observed at scale. The availability of a vendor patch (v5.0.0) and public GitHub Security Advisory means both defenders and potential attackers have full technical details. Priority should be high for multi-project deployments with untrusted or compartmentalized team members; risk is negligible for single-project or single-user instances.

An attacker with legitimate low-privilege access to ProjectA within TeamX authenticates to the Chartbrew instance and captures API requests to dataset or dataRequest endpoints. By enumerating or guessing dataset_id and connection_id values belonging to ProjectB (also in TeamX), the attacker directly calls the vulnerable endpoints with those foreign IDs. The application authorizes the request based solely on TeamX membership without validating ProjectA scope, allowing the attacker to retrieve sensitive data schemas, execute database queries through ProjectB's connections, modify chart datasets, or delete data requests belonging to projects they should not access.