CVE-2026-32252: Chartbrew authorization bypass in template generation API

CVE-2026-32252 · Severity: high · CVSS 7.7 · Published 2026-04-10

Chartbrew, an open-source dashboard and data visualization platform, contains a security flaw that allows users to access data belonging to other organizations or teams. By exploiting this vulnerability, an authorized user can bypass security boundaries to view sensitive project information, including database connection details and API credentials from other accounts. This could lead to the exposure of private business data and operational secrets.

Technologies: Depomo Chartbrew. Vendors: Depomo.

Quick answers

Is CVE-2026-32252 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32252 being exploited in the wild.
How severe is CVE-2026-32252?
High severity, with a CVSS score of 7.7, published 10 April 2026.
Which products and versions are affected?
Chartbrew Chartbrew < 4.9.0.
Is there a fix for CVE-2026-32252?
A patch was published on 2026-03-11: Fix committed to repository. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32252 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32252?
Check whether you run Depomo Chartbrew. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A cross-tenant authorization bypass exists in the 'GET /team/:team_id/template/generate/:project_id' endpoint. The vulnerability is caused by two primary failures: the GET handler calls 'checkAccess' without awaiting the returned promise, and it fails to verify that the requested 'project_id' actually belongs to the 'team_id' associated with the authenticated user. An attacker with valid template-generation permissions in their own team can provide a victim's project ID to export its template. This export includes sensitive decrypted data such as connection hosts, request headers (containing bearer tokens), and request bodies. The issue was addressed in version 4.9.0 by properly awaiting authorization checks and enforcing project ownership validation.

Affected products

  • Chartbrew Chartbrew < 4.9.0

Timeline

  • 2026-03-11: patched: Fix committed to repository.
  • 2026-04-10: advisory: GitHub Security Advisory published.
  • 2026-04-10: disclosed: CVE-2026-32252 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.