CVE-2026-40904

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40904

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40904.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40904

Aliases

GHSA-jq95-gqww-vhm3

Published

2026-04-30T18:20:44.432Z

Modified

2026-08-04T11:50:54.018282790Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Chartbrew: Incorrect Access Control in dataset and dataRequest routes via team-scoped permission checks

Details

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest endpoints that authorize low-privileged project members at the team level instead of binding the requested datasetid, dataRequest id, and connectionid to the caller's allowed projects. An authenticated attacker who only has access to one project inside a team can read, execute, create, update, and delete datasets and data requests that belong to other projects in the same team. The issue is exploitable remotely with ordinary project-level credentials and leads to cross-project data disclosure and unauthorized use of victim-side database or API connections. This issue has been patched in version 5.0.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40904.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/chartbrew/chartbrew

Affected ranges

Type

GIT

Repo

https://github.com/chartbrew/chartbrew

Events

Introduced

7cf1713c5a14d36cf88f4e5f467ddc74d7c6f600

Last affected

7cf1713c5a14d36cf88f4e5f467ddc74d7c6f600

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "= 4.9.0"
        },
        {
            "last_affected": "= 4.9.0"
        }
    ]
}

Affected versions

= 4.*

= 4.9.0

v4.*

v4.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40904.json"