CVE-2026-40601: Chartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chartid/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40601?
CVE-2026-40601 has been classified as a high severity vulnerability due to the missing authorization in Chartbrew's API.
How do I fix CVE-2026-40601?
To resolve CVE-2026-40601, upgrade to Chartbrew version 5.0.0 or later where the issue has been addressed.
What are the consequences of CVE-2026-40601?
CVE-2026-40601 could allow unauthorized users to access and query chart data, potentially leading to data exposure.
Which versions of Chartbrew are affected by CVE-2026-40601?
Chartbrew versions prior to 5.0.0 are vulnerable to CVE-2026-40601.
Is CVE-2026-40601 a critical issue for Chartbrew users?
Yes, CVE-2026-40601 is critical for Chartbrew users as it undermines the application’s security and data protection.