# CVE-2026-68933: Chartbrew dashboard password brute force via plaintext storage

Source: https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-68933 · Severity: high · CVSS 7.5 · Published 2026-11-06

Chartbrew is an open-source web application that creates charts from data stored in databases and APIs. Prior to version 5.2.3, password-protected public dashboards stored passwords in plaintext and accepted them via URL query parameters without rate limiting, allowing attackers to brute force access. An attacker who cracks the password gains full access to the dashboard and all its underlying chart data.

Technologies: [Chartbrew](https://junglewise.ai/threats/technologies/chartbrew-chartbrew). Vendors: [Chartbrew](https://junglewise.ai/threats/vendors/chartbrew).

## Quick answers

**Is CVE-2026-68933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68933 being exploited in the wild.

**How severe is CVE-2026-68933?** High severity, with a CVSS score of 7.5, published 6 November 2026.

**Which products and versions are affected?** Chartbrew before 5.2.3.

**Is there a fix for CVE-2026-68933?** Yes: fixed in 5.2.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-68933 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-68933?** Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.3

## Technical details

The vulnerability involves plaintext storage of dashboard passwords, acceptance of passwords through URL query parameters, and absence of rate limiting on password validation attempts. An unauthenticated attacker can target a public password-protected dashboard and submit unlimited candidate passwords to guess the correct one. Failed attempts still leak dashboard metadata (chart count and configuration), and recovered passwords grant access to protected chart data. The fix in 5.2.3 encrypts dashboard passwords and implements rate limiting on validation routes.

## Affected products

- Chartbrew Chartbrew before 5.2.3

## Timeline

- 2026-11-06: disclosed
- 2026-07-06: patched: Fix committed; v5.2.3 released 19 Jul 2026

## References

- [https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6](https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6)
- [https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3)

## Related threats

- [Chartbrew AI SQL blocklist bypass in PostgreSQL query validation](https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew API connection private host bypass](https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts)
- [Chartbrew BullMQ dashboard authentication bypass](https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew arbitrary file deletion via connection cleanup](https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew MongoDB query injection in date-typed variables](https://junglewise.ai/threats/cve-2026-85726-chartbrew-is-an-open-source-web-application-that-can-connect)