CVE-2026-40904 - Vulnerability Analysis

Overview

Chartbrew 4.9.0 contains a broken access control caused by improper authorization of dataset and dataRequest endpoints, letting authenticated low-privileged project members access and modify data across projects in the same team, exploit requires attacker to have project-level credentials.

Severity & Score

Impact

Attackers can read, modify, and delete data across projects, leading to data disclosure and unauthorized use of database or API connections.

Mitigation

Upgrade to version 5.0.0 or later.

References

• https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-jq95-gqww-vhm3

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner