CVE-2026-25877: Chartbrew: Insecure Direct Object Reference (IDOR) in Chart Operations
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the application performs authorization checks based solely on the projectid parameter when handling chart-related operations (update, delete, etc.). No authorization check is performed against the chartid itself. This allows an authenticated user who has access to any project to manipulate or access charts belonging to other users/ project. This issue has been patched in version 4.8.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25877?
CVE-2026-25877 is classified as a medium severity vulnerability due to its potential for unauthorized data access.
How do I fix CVE-2026-25877?
To fix CVE-2026-25877, upgrade Chartbrew to version 4.8.1 or later where the vulnerability has been addressed.
What causes CVE-2026-25877?
CVE-2026-25877 is caused by inadequate authorization checks for direct object references in Chartbrew.
Who is affected by CVE-2026-25877?
Users running Chartbrew versions prior to 4.8.1 are affected by CVE-2026-25877.
What are the potential impacts of CVE-2026-25877?
The potential impacts of CVE-2026-25877 include unauthorized access to sensitive data within a project.