CVE-2026-27603: Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:projectid/chart/:chartid/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27603?
CVE-2026-27603 is classified as a high severity vulnerability due to its unauthenticated access to sensitive chart filter endpoints.
How do I fix CVE-2026-27603?
To fix CVE-2026-27603, upgrade Chartbrew to version 4.8.4 or later, where the vulnerability is addressed.
What kind of access does CVE-2026-27603 allow?
CVE-2026-27603 allows unauthorized users to filter charts without authentication, posing a risk to data security.
Which versions of Chartbrew are affected by CVE-2026-27603?
Chartbrew versions prior to 4.8.4 are affected by CVE-2026-27603.
Is there a patch available for CVE-2026-27603?
Yes, the patch for CVE-2026-27603 is included in Chartbrew version 4.8.4.