Chartbrew
Monthly
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Unauthenticated remote attackers can access and refresh private chart data in Chartbrew 4.9.0 via an exposed API endpoint. The POST /api/chart/:chart_id/query endpoint lacks authentication checks and fails to validate whether charts belong to public reports or if sharing policies permit access. Attackers possessing a chart identifier can retrieve sensitive data from private dashboards without credentials. EPSS data not available. Not listed in CISA KEV. Vendor-confirmed vulnerability with patch released in version 5.0.0.
Authenticated users in Chartbrew 4.9.0 can modify or delete dashboard sharing policies across projects they don't own due to insufficient authorization checks. An attacker with legitimate access to one project can manipulate SharePolicy records (visibility settings, passwords, allowed parameters, expiration dates) for dashboards in any other project within the same Chartbrew instance. While CVSS rates this 8.1 HIGH, real-world risk depends heavily on multi-tenancy deployment: single-organization instances face lower insider threat exposure than multi-tenant SaaS scenarios. EPSS data not available. No public exploit identified at time of analysis, though exploitation requires only basic authenticated API access.
Chartbrew 4.9.0 allows unauthenticated attackers to access hidden chart data via authentication bypass in public chart export routes. Attackers who know a chart identifier in any public project can read or export charts that were intentionally excluded from public reports, bypassing SharePolicy access controls. The vulnerability requires only network access and a valid chart ID, with no authentication or user interaction needed. Patched in version 5.0.0 per vendor advisory GHSA-mq7q-6xh6-5649. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L).
Horizontal privilege escalation in Chartbrew 4.9.0 allows authenticated low-privilege team members to access datasets, data requests, and database connections belonging to other projects within the same team. Attackers with credentials to any single project can read, modify, create, and delete data assets across all sibling projects by exploiting missing project-level authorization checks on multiple API endpoints. This enables cross-project data exfiltration and unauthorized execution of victim database queries remotely with low complexity (EPSS not provided, no CISA KEV listing, vendor-patched in v5.0.0).
Cross-tenant authorization bypass in Chartbrew versions prior to 4.9.0 allows authenticated attackers to exfiltrate sensitive project data from other tenants. The vulnerability exists in the template generation endpoint (GET /team/:team_id/template/generate/:project_id), where unawaited promise execution and missing tenant validation enable attackers with valid template-generation permissions in their own team to access chart configurations, database connection details, and query structures from victim teams' projects. No public exploit identified at time of analysis. CVSS 7.7 reflects high confidentiality impact with scope change due to cross-tenant boundary violation.
Server-Side Request Forgery in Chartbrew versions prior to 4.8.5 allows authenticated users to create API data connections with arbitrary URLs, enabling attacks against internal networks and cloud metadata endpoints. The vulnerability stems from unvalidated URL fetching via request-promise library, permitting attackers to probe internal infrastructure, access cloud instance metadata (AWS, Azure, GCP), and potentially retrieve sensitive credentials or configuration data. No public exploit identified at time of analysis. CVSS 7.8 with network attack vector and no authentication requirement in subsequent chain exploitation.
Chartbrew versions up to 4.8.4 is affected by missing authentication for critical function (CVSS 7.5).
SQL injection in Chartbrew before 4.8.3. PoC available.
Remote code execution in Chartbrew prior to version 4.8.1 allows authenticated attackers to execute arbitrary code through a vulnerable API endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers with valid credentials can achieve full system compromise including data exfiltration and integrity violations.
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execute arbitrary code through malicious MongoDB dataset queries. The vulnerability affects users connecting Chartbrew to MongoDB databases for chart creation and has active public exploit code available. No patch is currently available for affected versions.
Authenticated Chartbrew users with access to the AI chart-generation feature can execute dangerous SQL statements and database functions that the application's read-only filter fails to block, because versions prior to 5.2.2 relied on a blocklist covering only seven keywords (DROP, DELETE, UPDATE, INSERT, TRUNCATE, ALTER, CREATE). Depending on the database engine, its configuration, and the privileges of the configured connection user, this can result in file read/write, outbound network access from the database server, privilege changes, command execution, or data modification - the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, reflecting high confidentiality and integrity impact to the connected database with scope change. Exploitation requires a valid Chartbrew account on a team with the AI feature enabled and configured against a postgres, mysql, or clickhouse connection; no public exploit code was identified at time of analysis and there is no CISA KEV listing, making this an access-gated issue rather than a mass-exploitation emergency.
SQL injection in Chartbrew versions prior to 5.2.2 allows an authenticated user with access to the AI query orchestrator to smuggle arbitrary SQL into the database by influencing the model-generated row_limit value, which is concatenated into a trailing LIMIT clause after the application's read-only keyword check has already executed. Exploitation is conditional rather than trivial: the attacker cannot pass row_limit directly but must steer the LLM into emitting a non-integer value, and the connected data source must be of type postgres, mysql, or clickhouse for the vulnerable code path to apply. Impact is bounded by the privileges of the database account Chartbrew uses - data can be read or modified, and where that account has file or command privileges, file access or OS command execution becomes possible; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, with the vendor fix shipping in 5.2.2.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Chartbrew 4.9.0 fails to properly enforce project-level access controls on a legacy dashboard route, allowing any authenticated team member to read another team member's project report data and extract stored report passwords. The vulnerability affects users without explicit project access but with team membership, who can leverage the unprotected endpoint to view sensitive dashboard configurations and credentials. Patched in version 5.0.0.
Unauthenticated account creation in Chartbrew 4.9.0 allows any remote attacker to bypass signup restrictions and create a fully active account with valid JWT via the unprotected POST /user/invited endpoint, circumventing the signupRestricted configuration that normally blocks new registrations. An attacker receives a functional JWT token immediately without email verification, granting full authenticated access even when the instance restricts signups to invited users only. The vulnerability was patched in version 5.0.0.
Chartbrew versions prior to 4.8.4 allow authenticated users to upload arbitrary files by bypassing file type validation, enabling stored XSS attacks through malicious HTML files served from the uploads directory. An attacker can exploit this to steal authentication tokens stored in localStorage and achieve account takeover. Public exploit code exists for this vulnerability, and no patch is currently available.
Chartbrew versions before 4.8.1 fail to validate chart ownership during modification operations, allowing authenticated users to read, modify, or delete charts from other projects they shouldn't access. An attacker with valid credentials to any project can exploit this authorization bypass to manipulate arbitrary charts across the application. Public exploit code exists for this vulnerability, and no patch is currently available.
SQL injection in Chartbrew versions prior to 5.2.3 allows an unauthenticated remote attacker to break out of an intended string literal and execute arbitrary ClickHouse SQL whenever a ClickHouse-backed chart uses variable binding and the attacker controls the variable value; the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no privileges or user interaction are required, and the subsequent scope increase (SC:H/SI:H/SA:H) reflects impact landing on the ClickHouse data source rather than Chartbrew itself. The vulnerable path is fully exposed through public dashboards, while non-public dashboards require an authenticated session. Exploitation can disclose data stored in the ClickHouse instance and, where the ClickHouse configuration permits file or URL table functions, reach local files or internal network resources; vendor-released patch: 5.2.3, and no public exploit code has been identified at time of analysis. This is a genuine, high-priority CWE-89 issue with a credible unauthenticated path, though its reachability depends on the deployment using the ClickHouse plugin with variable bindings.
Unauthenticated remote attackers can access and refresh private chart data in Chartbrew 4.9.0 via an exposed API endpoint. The POST /api/chart/:chart_id/query endpoint lacks authentication checks and fails to validate whether charts belong to public reports or if sharing policies permit access. Attackers possessing a chart identifier can retrieve sensitive data from private dashboards without credentials. EPSS data not available. Not listed in CISA KEV. Vendor-confirmed vulnerability with patch released in version 5.0.0.
Authenticated users in Chartbrew 4.9.0 can modify or delete dashboard sharing policies across projects they don't own due to insufficient authorization checks. An attacker with legitimate access to one project can manipulate SharePolicy records (visibility settings, passwords, allowed parameters, expiration dates) for dashboards in any other project within the same Chartbrew instance. While CVSS rates this 8.1 HIGH, real-world risk depends heavily on multi-tenancy deployment: single-organization instances face lower insider threat exposure than multi-tenant SaaS scenarios. EPSS data not available. No public exploit identified at time of analysis, though exploitation requires only basic authenticated API access.
Chartbrew 4.9.0 allows unauthenticated attackers to access hidden chart data via authentication bypass in public chart export routes. Attackers who know a chart identifier in any public project can read or export charts that were intentionally excluded from public reports, bypassing SharePolicy access controls. The vulnerability requires only network access and a valid chart ID, with no authentication or user interaction needed. Patched in version 5.0.0 per vendor advisory GHSA-mq7q-6xh6-5649. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L).
Horizontal privilege escalation in Chartbrew 4.9.0 allows authenticated low-privilege team members to access datasets, data requests, and database connections belonging to other projects within the same team. Attackers with credentials to any single project can read, modify, create, and delete data assets across all sibling projects by exploiting missing project-level authorization checks on multiple API endpoints. This enables cross-project data exfiltration and unauthorized execution of victim database queries remotely with low complexity (EPSS not provided, no CISA KEV listing, vendor-patched in v5.0.0).
Cross-tenant authorization bypass in Chartbrew versions prior to 4.9.0 allows authenticated attackers to exfiltrate sensitive project data from other tenants. The vulnerability exists in the template generation endpoint (GET /team/:team_id/template/generate/:project_id), where unawaited promise execution and missing tenant validation enable attackers with valid template-generation permissions in their own team to access chart configurations, database connection details, and query structures from victim teams' projects. No public exploit identified at time of analysis. CVSS 7.7 reflects high confidentiality impact with scope change due to cross-tenant boundary violation.
Server-Side Request Forgery in Chartbrew versions prior to 4.8.5 allows authenticated users to create API data connections with arbitrary URLs, enabling attacks against internal networks and cloud metadata endpoints. The vulnerability stems from unvalidated URL fetching via request-promise library, permitting attackers to probe internal infrastructure, access cloud instance metadata (AWS, Azure, GCP), and potentially retrieve sensitive credentials or configuration data. No public exploit identified at time of analysis. CVSS 7.8 with network attack vector and no authentication requirement in subsequent chain exploitation.
Chartbrew versions up to 4.8.4 is affected by missing authentication for critical function (CVSS 7.5).
SQL injection in Chartbrew before 4.8.3. PoC available.
Remote code execution in Chartbrew prior to version 4.8.1 allows authenticated attackers to execute arbitrary code through a vulnerable API endpoint. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers with valid credentials can achieve full system compromise including data exfiltration and integrity violations.
Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execute arbitrary code through malicious MongoDB dataset queries. The vulnerability affects users connecting Chartbrew to MongoDB databases for chart creation and has active public exploit code available. No patch is currently available for affected versions.
Authenticated Chartbrew users with access to the AI chart-generation feature can execute dangerous SQL statements and database functions that the application's read-only filter fails to block, because versions prior to 5.2.2 relied on a blocklist covering only seven keywords (DROP, DELETE, UPDATE, INSERT, TRUNCATE, ALTER, CREATE). Depending on the database engine, its configuration, and the privileges of the configured connection user, this can result in file read/write, outbound network access from the database server, privilege changes, command execution, or data modification - the independent assessment rates it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, reflecting high confidentiality and integrity impact to the connected database with scope change. Exploitation requires a valid Chartbrew account on a team with the AI feature enabled and configured against a postgres, mysql, or clickhouse connection; no public exploit code was identified at time of analysis and there is no CISA KEV listing, making this an access-gated issue rather than a mass-exploitation emergency.
SQL injection in Chartbrew versions prior to 5.2.2 allows an authenticated user with access to the AI query orchestrator to smuggle arbitrary SQL into the database by influencing the model-generated row_limit value, which is concatenated into a trailing LIMIT clause after the application's read-only keyword check has already executed. Exploitation is conditional rather than trivial: the attacker cannot pass row_limit directly but must steer the LLM into emitting a non-integer value, and the connected data source must be of type postgres, mysql, or clickhouse for the vulnerable code path to apply. Impact is bounded by the privileges of the database account Chartbrew uses - data can be read or modified, and where that account has file or command privileges, file access or OS command execution becomes possible; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, with the vendor fix shipping in 5.2.2.
Outbound request validation bypass via DNS rebinding in Chartbrew before 5.2.2 allows an authenticated user who can create or test API/data-source connections, and who controls DNS for the target hostname, to make the server reach internal services, localhost resources, or cloud metadata endpoints. The server validates the hostname with validateOutboundUrl() but the actual connection is performed by request-promise using an independent DNS lookup, so a public address can be returned during validation and a private address during the request. No public exploit identified at time of analysis; exploitation requires a credentialed account and attacker-controlled DNS plus winning the race between the two lookups, so real-world risk is moderate rather than high.
Chartbrew 4.9.0 fails to properly enforce project-level access controls on a legacy dashboard route, allowing any authenticated team member to read another team member's project report data and extract stored report passwords. The vulnerability affects users without explicit project access but with team membership, who can leverage the unprotected endpoint to view sensitive dashboard configurations and credentials. Patched in version 5.0.0.
Unauthenticated account creation in Chartbrew 4.9.0 allows any remote attacker to bypass signup restrictions and create a fully active account with valid JWT via the unprotected POST /user/invited endpoint, circumventing the signupRestricted configuration that normally blocks new registrations. An attacker receives a functional JWT token immediately without email verification, granting full authenticated access even when the instance restricts signups to invited users only. The vulnerability was patched in version 5.0.0.
Chartbrew versions prior to 4.8.4 allow authenticated users to upload arbitrary files by bypassing file type validation, enabling stored XSS attacks through malicious HTML files served from the uploads directory. An attacker can exploit this to steal authentication tokens stored in localStorage and achieve account takeover. Public exploit code exists for this vulnerability, and no patch is currently available.
Chartbrew versions before 4.8.1 fail to validate chart ownership during modification operations, allowing authenticated users to read, modify, or delete charts from other projects they shouldn't access. An attacker with valid credentials to any project can exploit this authorization bypass to manipulate arbitrary charts across the application. Public exploit code exists for this vulnerability, and no patch is currently available.