Vulnerability · Published Mar 6, 2026 · Assigned by GitHub_M

CVE-2026-25877Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations

Medium 6.5

In plain English

A medium-severity improper access control in chartbrew from chartbrew. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the project_id parameter when handling chart-related operations (update, delete, etc.). No authorization check is performed against the chart_id itself. This allows an authenticated user who has access to any project to manipulate or access charts belonging to other users/ project. This issue has been patched in version 4.8.1.

Affected products (as reported)

Vendor	Product	Versions
chartbrew	chartbrew	< 4.8.1

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fcr-x8x8-mrxc x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/releases/tag/v4.8.1 x_refsource_MISC