CVE-2026-85708: Chartbrew: Private chart data disclosure via forgeable CB_SECRET share tokens
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CBSECRET, including known or shipped-default values in stock source and repository Docker Compose installs. The vulnerable surface is chart share-token verification and filter-access routes for private charts. An attacker who knows the deployment's CBSECRET targets a private chart that has been shared at least once so a share-policy row exists, then forges a Chart-subject token for that chart id. The known signing key permits valid Chart tokens, and the filter-access path accepts sequential integer ids without requiring a legitimate share link; token expiry and revocation are ineffective once the secret is known. The condition requires a known or default secret and an existing share-policy row. A bare container where CBSECRET is undefined is outside this path, and a unique secret excludes it only while the value remains unknown and unpredictable. An unauthenticated attacker can enumerate integer ids and read arbitrary private chart data, including chartData, without possessing a legitimate share link. This issue is fixed in version 5.2.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Chartbrewto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments prior to 5.2.3 are exposed when CB_SECRET is a known or shipped-default value and the target private chart has been shared at least once, creating a share-policy row. A bare container with CB_SECRET undefined is outside this attack path; a unique secret is protective only while it remains unknown and unpredictable.
What does an attacker need to exploit this?
The attacker needs the deployment's CB_SECRET and a target private chart with an existing share-policy row. They do not need a legitimate share link or authentication, because they can forge a Chart-subject token for a chart ID and enumerate sequential integer IDs.
What data could be accessed?
An unauthenticated attacker can read arbitrary private chart data, including chartData, through the share-token verification and filter-access routes. Token expiration and revocation do not prevent access after the signing secret is known.
How can I determine whether my instance may already be affected?
Review whether the instance runs a version before 5.2.3 and whether CB_SECRET uses a known, shipped-default, exposed, or otherwise predictable value. Also identify private charts that have been shared at least once, since those charts have the required share-policy row.
What should be prioritized if immediate upgrading is not possible?
Replace any known, default, or predictable CB_SECRET with a unique unpredictable value, recognizing that the provided data does not state whether this invalidates existing tokens. Prioritize private charts that have been shared, because they meet the share-policy condition required for exploitation.