Unauthorized Data Access in Chartbrew Open Source Web Application
CVE-2026-27603

8.7HIGH

Key Information:

Vendor

Chartbrew

Status
Chartbrew
Vendor
CVE Published:
6 March 2026

What is CVE-2026-27603?

Chartbrew is a web application designed to create charts from various data sources, including databases and APIs. A significant vulnerability exists in versions prior to 4.8.4, where the chart filter endpoint (/project/:project_id/chart/:chart_id/filter) lacks essential security middleware, such as verifyToken and checkPermissions. This oversight allows unauthenticated users to gain access to chart data across different teams and projects, potentially exposing sensitive information. The issue has been resolved in version 4.8.4, emphasizing the importance of implementing robust access controls in web applications.

Affected Version(s)

chartbrew < 4.8.4

References

https://github.com/chartbrew/chartbrew/security/advisorie...
x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.