CVE-2026-40595 Chartbrew: Incorrect Access Control in public chart and export routes via missing onReport and SharePolicy checks
Unauthenticated attackers can read or export hidden chart data in Chartbrew by bypassing report and share policy checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40595?
CVE-2026-40595 is a high-severity missing authorization vulnerability in chartbrew, published on 30 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes public chart retrieval and export routes that only verify project-level public access and, for exports, a team-level export toggle. The routes do not verify whether the target chart is actually allowed on the public report or whether the governing SharePolicy permits public access. An unauthenticated attacker who knows a chart identifier in a public project can read or export chart data for charts that were intentionally hidden from the report. This issue has been patched in version 5.0.0.
Weakness: CWE-284
Which versions are affected by CVE-2026-40595?
How do I fix CVE-2026-40595?
No fix has been published for CVE-2026-40595 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40595 exists.
Sources
Also known as GHSA-mq7q-6xh6-5649.