# CVE-2026-85712: Chartbrew authorization bypass via tenant boundary confusion

Source: https://junglewise.ai/threats/cve-2026-85712-chartbrew-is-an-open-source-web-application-that-can-connect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-85712 · Severity: high · CVSS 8.8 · Published 2026-11-06

Chartbrew is an open-source data visualization platform that connects to databases and APIs to create charts. An authenticated attacker with team admin privileges could gain unauthorized access to other teams' projects, modify them, expose sensitive data, or delete them entirely. The vulnerability exploits a flaw where the application trusts user-supplied team identifiers instead of validating that projects belong to the requesting team.

Technologies: [Chartbrew](https://junglewise.ai/threats/technologies/chartbrew-chartbrew). Vendors: [Chartbrew](https://junglewise.ai/threats/vendors/chartbrew).

## Quick answers

**Is CVE-2026-85712 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85712 being exploited in the wild.

**How severe is CVE-2026-85712?** High severity, with a CVSS score of 8.8, published 6 November 2026.

**Which products and versions are affected?** Chartbrew prior to 5.2.3.

**Is there a fix for CVE-2026-85712?** Yes: fixed in 5.2.3. Until then: Restrict team admin role assignment to trusted users only; use role-based access control to limit who can create or manage teams. Upgrade to version 5.2.3 or later immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85712 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85712?** Check whether you run Chartbrew at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.2.3

Restrict team admin role assignment to trusted users only; use role-based access control to limit who can create or manage teams. Upgrade to version 5.2.3 or later immediately.

## Technical details

The vulnerability is a broken access control flaw in Chartbrew's project authorization checks prior to version 5.2.3. Authenticated users who are team owners or admins can bypass authorization by submitting a caller-controlled team_id in the request body; the application evaluates permissions against the attacker's team rather than the target project's actual team, then mass-assigns request body parameters without validation. An attacker requires a valid Chartbrew account with team owner/admin role (achievable via default self-signup), knowledge of a victim project ID, and can re-parent projects, modify access controls, and trigger deletion across tenant boundaries.

## Affected products

- Chartbrew Chartbrew prior to 5.2.3

## Timeline

- 2026-11-06: disclosed
- 2026-07-18: patched: Commit enforcing project tenant boundaries merged

## References

- [https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5](https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5)
- [https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3](https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3)

## Related threats

- [Chartbrew AI SQL blocklist bypass in PostgreSQL query validation](https://junglewise.ai/threats/cve-2026-69128-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew API connection private host bypass](https://junglewise.ai/threats/cve-2026-68935-chartbrew-is-an-open-source-web-application-for-creating-charts)
- [Chartbrew dashboard password brute force via plaintext storage](https://junglewise.ai/threats/cve-2026-68933-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew BullMQ dashboard authentication bypass](https://junglewise.ai/threats/cve-2026-86005-chartbrew-is-an-open-source-web-application-that-can-connect)
- [Chartbrew arbitrary file deletion via connection cleanup](https://junglewise.ai/threats/cve-2026-85736-chartbrew-is-an-open-source-web-application-that-can-connect)