Executive brief
Chartbrew, an open-source dashboard and data visualization platform, contains a security flaw that allows users to access data belonging to other organizations or teams. By exploiting this vulnerability, an authorized user can bypass security boundaries to view sensitive project information, including database connection details and API credentials from other accounts. This could lead to the exposure of private business data and operational secrets.
Technical details
A cross-tenant authorization bypass exists in the 'GET /team/:team_id/template/generate/:project_id' endpoint. The vulnerability is caused by two primary failures: the GET handler calls 'checkAccess' without awaiting the returned promise, and it fails to verify that the requested 'project_id' actually belongs to the 'team_id' associated with the authenticated user. An attacker with valid template-generation permissions in their own team can provide a victim's project ID to export its template. This export includes sensitive decrypted data such as connection hosts, request headers (containing bearer tokens), and request bodies. The issue was addressed in version 4.9.0 by properly awaiting authorization checks and enforcing project ownership validation.
Affected products
- Chartbrew Chartbrew < 4.9.0
Timeline
- 2026-03-11: patched: Fix committed to repository.
- 2026-04-10: advisory: GitHub Security Advisory published.
- 2026-04-10: disclosed: CVE-2026-32252 published.