CVE-2026-40595

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40595

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40595.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40595

Aliases

GHSA-mq7q-6xh6-5649

Published

2026-04-30T18:21:28.551Z

Modified

2026-08-04T11:48:46.498109132Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks

Details

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40595.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/chartbrew/chartbrew

Affected ranges

Type

GIT

Repo

https://github.com/chartbrew/chartbrew

Events

Introduced

7cf1713c5a14d36cf88f4e5f467ddc74d7c6f600

Last affected

7cf1713c5a14d36cf88f4e5f467ddc74d7c6f600

Database specific

{
    "extracted_events": [
        {
            "introduced": "= 4.9.0"
        },
        {
            "last_affected": "= 4.9.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

= 4.*

= 4.9.0

v4.*

v4.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40595.json"