CVE-2026-27603 Missing authorization in chartbrew
Unauthenticated attackers can access chart data from any team or project due to missing authentication and permission checks on the filter endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27603?
CVE-2026-27603 is a high-severity missing authorization vulnerability in chartbrew, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.
Weakness: CWE-306
Which versions are affected by CVE-2026-27603?
It affects 1 product.
Products include Depomo Chartbrew.
How do I fix CVE-2026-27603?
No fix has been published for CVE-2026-27603 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-27603 being exploited?
There is no known exploitation of CVE-2026-27603 in the wild and no public exploit code.
Other vulnerabilities in chartbrew
- CVE-2026-25888 Chartbrew: Remote Code Execution (RCE) via Vulnerable API
- CVE-2026-27005 Chartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)
- CVE-2026-30232 Chartbrew has SSRF in API Data Connection - No IP Validation on User-Provided URLs
- CVE-2026-32252 Chartbrew Cross-Tenant Template Export and Secret Disclosure in `GET /team/:team_id/template/generate/:project_id`
- CVE-2026-25887 Chartbrew: Remote Code Execution (RCE) via MongoDB Dataset Query
Sources
Also known as GHSA-9fhr-5vvc-p455.