CVEvulnerability

CVE-2026-32252

7.7 HIGH Published 2026-04-10 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-04-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-285

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.

Affected configurations

• depomo chartbrew (< 4.9.0)

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References