Chartbrew Vulnerability in Token Signing and Access Controls

CVE-2026-85708

What is CVE-2026-85708?

Chartbrew, an open-source web application for data visualization, suffers from an insecure token signing vulnerability affecting versions before 5.2.3. The issue stems from the use of the CB_SECRET in signing chart share and embed tokens. If an attacker gains knowledge of the deployment's CB_SECRET, they can exploit this vulnerability by forging tokens for any private chart that has been shared. This lack of robust access controls allows unauthorized individuals to enumerate chart IDs and access sensitive chart data without needing a valid share link. The issue is mitigated in version 5.2.3, where improvements to token management and access verification are implemented, emphasizing the importance of using unique and unpredictable secrets.

References