Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes a legacy dashboard route that returns a project's report data to any authenticated member of the same team, even when that user does not have access to the specific project. The route bypasses project-level authorization and returns the raw project object. As a result, a low-privileged same-team user can read another project's dashboard data and recover the project's stored report password from the response. This issue has been patched in version 5.0.0.
INFO
Published Date :
2026-04-30T18:23:39.706Z
Last Modified :
2026-04-30T19:04:07.506Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2026-40603 vulnerability.
| Vendors | Products |
|---|---|
| Chartbrew |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-40603.
