CVE-2026-25877 Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations
Authenticated users can access or modify charts belonging to other users due to missing authorization checks on chart IDs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25877?
CVE-2026-25877 is a medium-severity missing authorization vulnerability in chartbrew, published on 6 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the project_id parameter when handling chart-related operations (update, delete, etc.). No authorization check is performed against the chart_id itself. This allows an authenticated user who has access to any project to manipulate or access charts belonging to other users/ project. This issue has been patched in version 4.8.1.
Which versions are affected by CVE-2026-25877?
It affects 1 product.
Products include Depomo Chartbrew.
How do I fix CVE-2026-25877?
No fix has been published for CVE-2026-25877 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25877 being exploited?
There is no known exploitation of CVE-2026-25877 in the wild and no public exploit code.
Other vulnerabilities in chartbrew
- CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
- CVE-2026-27603 Missing authorization in chartbrew
- CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
Sources
Also known as GHSA-9fcr-x8x8-mrxc.