CVE-2026-85295: Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CBSECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CBSECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CBSECRET; a bare container where CBSECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Stock source deployments and repository Docker Compose deployments are affected because they retain a known, weak, or default CB_SECRET. Other deployments are affected if CB_SECRET is known or weak; bare containers with CB_SECRET undefined do not use the affected fallback path.
What does an attacker need to exploit it?
The attacker needs the symmetric CB_SECRET value when it is known, weak, or a shipped default. They can then create an HS256 JWT that decodes to a chosen user ID, without needing that user's password or two-factor authentication.
What access can a forged token provide?
A forged session impersonates the selected user across the API and socket layer. The attacker can exercise all Chartbrew privileges assigned to that user.
What is the available fix?
Upgrade Chartbrew to version 5.2.3, which fixes the issue.