CVE-2026-32252 | Chartbrew up to 4.8.x :project_id improper authorization (GHSA-mw4f-cf22-qpcj)

VDB-356925 · CVE-2026-32252 · GHSA-MW4F-CF22-QPCJ CHARTBREW UP TO 4.8.X :PROJECT_ID IMPROPER AUTHORIZATION HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.9 $0-$5k 0.47+ Summaryinfo A vulnerability identified as critical has been detected in Chartbrew up to 4.8.x. This affects an unknown function of the file /team/:team_id/template/generate/:project_id. Performing a manipulation results in improper authorization. This vulnerability is known as CVE-2026-32252. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component. Detailsinfo A vulnerability, which was classified as critical, was found in Chartbrew up to 4.8.x. This affects some unknown functionality of the file /team/:team_id/template/generate/:project_id. The manipulation with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on confidentiality. The summary by CVE is: Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-32252 since 03/11/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue. Upgrading to version 4.9.0 eliminates this vulnerability. Applying the patch bf5919043d3587fcbe76123aaabd9a0a9d1033f1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version. Productinfo Name Chartbrew Version 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 License open-source Website Product: https://github.com/chartbrew/chartbrew/ CPE 2.3info 🔒 🔒 🔒 CPE 2.2info 🔒 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 6.0 VulDB Meta Temp Score: 5.9 VulDB Base Score: 4.3 VulDB Temp Score: 4.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 7.7 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Improper authorization CWE: CWE-285 / CWE-266 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: Chartbrew 4.9.0 Patch: bf5919043d3587fcbe76123aaabd9a0a9d1033f1 Timelineinfo 03/11/2026 CVE reserved 04/10/2026 +29 days Advisory disclosed 04/10/2026 +0 days VulDB entry created 04/10/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-mw4f-cf22-qpcj Status: Confirmed CVE: CVE-2026-32252 (🔒) GCVE (CVE): GCVE-0-2026-32252 GCVE (VulDB): GCVE-100-356925 Entryinfo Created: 04/10/2026 22:27 Changes: 04/10/2026 22:27 (66) Complete: 🔍 Cache ID: 99:C9B:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸