Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-35514 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /us… https://www.cve.org/CVERecord?id=CVE-2026-35514
Post summary
The statement references CVE-2026-35514 but only cites a CVE record link, lacking technical details, patches, or exploitation information.
CVE-2026-35514 Unauthenticated Account Creation and JWT Generation in Chartbrew 4.9.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35514
Post summary
A Vulmon vulnerability listing reports CVE‑2026‑35514 as enabling unauthenticated account creation and JWT generation in Chartbrew 4.9.0, with no PoC, exploit, patch or active exploitation details provided.
🚨*CVE* CVE-2026-35514 Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /us… https://www.cve.org/CVERecord?id=CVE-2026-35514 ----- Traducción: CVE-2026-35514 Cha… http://infoflow.cloud`
Post summary
The text mentions CVE-2026-35514 and links to its CVE record but provides no further technical, exploit, or mitigation information.