Password Exposure in Chartbrew Open-Source Application

CVE-2026-68933

What is CVE-2026-68933?

Chartbrew, an open-source web application for visualizing data through charts, has a significant vulnerability affecting versions prior to 5.2.3. The issue arises from the insecure handling of public dashboard passwords, which are stored in plaintext and can be passed as URL query parameters. This flaw allows unauthenticated attackers to repeatedly attempt to guess passwords, leveraging unlimited online guesses to execute brute-force attacks. Additionally, even failed attempts can disclose information about chart counts and configurations. If an attacker is successful in recovering a password, they gain unauthorized access to the protected dashboard and its sensitive chart data. A fix has been implemented in version 5.2.3.

References