Chartbrew EUVD-2026-26407

Requires the target Chartbrew instance to have at least one public project configured with team-level chart export functionality enabled. The attacker must obtain or enumerate valid chart identifiers, which may be exposed through browser developer tools on public dashboards, predictable ID sequences, or information leakage in API responses. Exploitation succeeds against default configurations of Chartbrew 4.9.0 when public projects exist, as the vulnerability is in the route authorization logic itself rather than optional features. No authentication required (PR:N), no user interaction needed (UI:N), and remotely exploitable (AV:N). Limiting factors: attacker must know the target has public projects, must discover valid chart IDs, and can only access data within charts in public projects (not private projects). Organizations without public projects enabled or without sensitive data hidden from public reports are not practically vulnerable despite running affected code.

Real-world risk is MODERATE despite the 7.5 CVSS score (High severity). The CVSS vector confirms network-based unauthenticated exploitation with high confidentiality impact (C:H), but no integrity or availability impact (I:N/A:N). Exploitation requires the attacker to know or enumerate valid chart identifiers in a public project, which represents a significant practical barrier. The vulnerability is limited to data disclosure of intentionally-hidden charts rather than full database access or system compromise. No EPSS or KEV data provided, but no public exploit identified at time of analysis. The attack complexity is low (AC:L) once a valid chart ID is obtained, making this exploitable via automated scanning if chart IDs are predictable. Primary risk is confidential business intelligence or sensitive data exposure in multi-tenant deployments where organizations rely on chart-level access controls to hide data subsets from public dashboards. Organizations not using the public report feature or those without sensitive data distinctions between public and hidden charts face minimal risk. Patch availability in version 5.0.0 is vendor-confirmed via GitHub security advisory and release notes.

An external attacker identifies a Chartbrew instance with public projects by browsing the application or through reconnaissance. The attacker enumerates or guesses valid chart identifiers (potentially through incremental ID scanning or leaked references in public reports) and crafts direct HTTP requests to the export API endpoints with these chart IDs. Because the routes only verify project-level public access without validating chart-level SharePolicy permissions, the attacker successfully retrieves data from charts intentionally hidden from public view, potentially exposing confidential business metrics, customer data, or internal analytics that should remain private.