{"api_version":"1","generated_at":"2026-05-12T09:39:16+00:00","cve":"CVE-2026-40595","urls":{"html":"https://cve.report/CVE-2026-40595","api":"https://cve.report/api/cve/CVE-2026-40595.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-40595","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-40595"},"summary":{"title":"Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-04-30 19:16:09","updated_at":"2026-05-01 15:31:02"},"problem_types":["CWE-284","CWE-284 CWE-284: Improper Access Control"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.5","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649","name":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0","name":"https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40595","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40595","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"chartbrew","product":"chartbrew","version":"affected = 4.9.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"40595","cve":"CVE-2026-40595","epss":"0.000480000","percentile":"0.145640000","score_date":"2026-05-05","updated_at":"2026-05-06 00:08:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-40595","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-30T19:01:17.356025Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-04-30T19:02:16.378Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"chartbrew","vendor":"chartbrew","versions":[{"status":"affected","version":"= 4.9.0"}]}],"descriptions":[{"lang":"en","value":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284: Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-30T18:21:28.551Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mq7q-6xh6-5649"},{"name":"https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0","tags":["x_refsource_MISC"],"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0"}],"source":{"advisory":"GHSA-mq7q-6xh6-5649","discovery":"UNKNOWN"},"title":"Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-40595","datePublished":"2026-04-30T18:21:28.551Z","dateReserved":"2026-04-14T14:07:59.641Z","dateUpdated":"2026-04-30T19:02:16.378Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-30 19:16:09","lastModifiedDate":"2026-05-01 15:31:02","problem_types":["CWE-284","CWE-284 CWE-284: Improper Access Control"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"40595","Ordinal":"1","Title":"Chartbrew: Incorrect Access Control in public chart and export r","CVE":"CVE-2026-40595","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"40595","Ordinal":"1","NoteData":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.","Type":"Description","Title":"Chartbrew: Incorrect Access Control in public chart and export r"}]}}}