Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny", "chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-32252 Cross-Tenant Authorization Bypass in Chartbrew Prior to Version 4.9.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32252
Post summary
The entry references CVE‑2026‑32252 and identifies a cross‑tenant authorization bypass in Chartbrew before version 4.9.0, but it provides no exploit details, patches, or evidence of active exploitation.
CVE-2026-32252 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authoriz… https://www.cve.org/CVERecord?id=CVE-2026-32252
Post summary
CVE-2026-32252 affects Chartbrew with a cross‑tenant authorization flaw, and it is addressed in version 4.9.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | depomo | chartbrew | - | - | - |