CVE-2026-35514 Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew
Unauthenticated attackers can create active accounts and obtain valid JWTs via the /user/invited endpoint, bypassing signup restrictions in Chartbrew.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35514?
CVE-2026-35514 is a medium-severity missing authorization vulnerability in chartbrew, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0.
Weakness: CWE-306
Which versions are affected by CVE-2026-35514?
How do I fix CVE-2026-35514?
No fix has been published for CVE-2026-35514 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-35514 being exploited?
There is no known exploitation of CVE-2026-35514 in the wild and no public exploit code.
Sources
Also known as GHSA-g47g-v5cp-j8hp.