Authorization Flaw in Chartbrew Affects User Permissions and Project Access

CVE-2026-85712

What is CVE-2026-85712?

Chartbrew, an open-source web application that facilitates data visualization from databases and APIs, exhibits a critical authorization flaw prior to version 5.2.3. This vulnerability arises from the project's permission checks which fail to adequately verify that a project indeed belongs to a specific team. An authenticated user with owner or admin privileges can manipulate requests by substituting their team ID with that of another team while submitting a victim project ID. This enables the attacker to gain unauthorized access, permitting them to reassign projects to their own team, expose sensitive data publicly, and bypass any existing password protections. The flaw not only allows unauthorized updates and deletions across tenant projects but also fundamentally compromises the integrity of project ownership within the application. The issue has been addressed in version 5.2.3, highlighting the importance of regular updates and stringent access controls.

References