CVE-2026-40600

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40600

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40600.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40600

Aliases

GHSA-pq8h-2h99-39xm

Published

2026-04-30T18:22:16.038Z

Modified

2026-08-07T11:51:02.530643529Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Chartbrew: Incorrect Access Control in project share policy routes via unbound policy_id

Details

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew allows authenticated users with access to one project to update or delete a SharePolicy record that belongs to a different project. The affected routes authorize the caller against the project in the URL path, but they never verify that policy_id belongs to that project. This permits cross-project modification of dashboard sharing rules, including visibility, password requirements, allowed parameters, and expiration settings. This issue has been patched in version 5.0.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40600.json"
}

References

Affected packages

Git / github.com/chartbrew/chartbrew

Affected ranges

Type

GIT

Repo

https://github.com/chartbrew/chartbrew

Events

Introduced

7cf1713c5a14d36cf88f4e5f467ddc74d7c6f600

Fixed

266e7b27f15e2c3e1762199ca57bf380ec57c232

Database specific

{
    "extracted_events": [
        {
            "introduced": "= 4.9.0"
        },
        {
            "last_affected": "= 4.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

= 4.*

= 4.9.0

v4.*

v4.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40600.json"