CVE-2026-68933: Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.2.3
Event History
Frequently Asked Questions
Which deployments are exposed?
The affected surface is a public dashboard with password protection enabled. Deployments without public password-protected dashboards are not described as exposed by this issue.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They need to identify a public password-protected dashboard and can repeatedly submit password guesses; alternatively, they may recover passwords from application, server, or proxy logs that captured the URL query parameter.
Are password-protected dashboards fully concealed from unauthenticated users?
No. Failed password attempts still reveal the chart count and configuration, even when the attacker does not know the password. A recovered or guessed password provides access to the dashboard and its chart data.
What should be done if an immediate upgrade is not possible?
The provided information identifies public password-protected dashboards as the vulnerable target. Restricting public exposure of those dashboards and reviewing application, server, and proxy logs for password-bearing URLs can reduce exposure until the instance can be updated.
Which version fixes the issue?
Chartbrew 5.2.3 fixes the vulnerability.