Vulnerability · Published Apr 30, 2026 · Assigned by GitHub_M

CVE-2026-40595Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

High 7.5

In plain English

A high-severity improper access control in chartbrew from chartbrew. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 80.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.

Affected products (as reported)

Vendor	Product	Versions
chartbrew	chartbrew	= 4.9.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649 x_refsource_CONFIRM
https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0 x_refsource_MISC