{"id":"CVE-2026-68933","kind":"vulnerability","aliases":["CVE-2026-68933"],"related":[],"title":"Chartbrew: public dashboard passwords stored in plaintext and brute-forceable","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.","summary":"Chartbrew stores public dashboard passwords in plaintext and accepts them in URL query strings, and it does not effectively throttle password guesses. An unauthenticated attacker can brute-force a password-protected public dashboard or read the password from server or proxy logs, then see the protected chart data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chartbrew","dashboards","package","self-hosted"],"not_affected_if":["fixed-version","no-dashboard-passwords","no-public-dashboards"],"how_to_check":"- Check the Chartbrew version in use; affected releases are those before `5.2.3`.\n- Check whether any public dashboard has password protection enabled.\n- Review proxy and server access logs for requests carrying a `password` query parameter.","fix":"- Chartbrew: move to `5.2.3` or later.","status":"open","published_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","triaged_at":"2026-11-06T22:44:43+00:00","updated_at":"2026-11-06T22:44:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T22:44:43Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: move to `5.2.3` or later.","reach":"internet","title":"Chartbrew: public dashboard passwords stored in plaintext and brute-forceable","impact":"medium","summary":"Chartbrew stores public dashboard passwords in plaintext and accepts them in URL query strings, and it does not effectively throttle password guesses. An unauthenticated attacker can brute-force a password-protected public dashboard or read the password from server or proxy logs, then see the protected chart data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","self-hosted","dashboards"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker reads protected dashboard chart data and configuration","analyst_note":"","how_to_check":"- Check the Chartbrew version in use; affected releases are those before `5.2.3`.\n- Check whether any public dashboard has password protection enabled.\n- Review proxy and server access logs for requests carrying a `password` query parameter.","plain_action":"","needs_analyst":false,"not_affected_if":["fixed-version","no-public-dashboards","no-dashboard-passwords"],"who_is_affected":"Only deployments of Chartbrew before 5.2.3 that serve public dashboards with password protection enabled are exposed. Instances without public password-protected dashboards, or on 5.2.3 or later, are not affected. Access logs for those dashboards may already contain the password.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4453,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-68933':14A,17A '5.2.3':99C,220C 'accept':32B,107C 'access':178C,206C 'api':89C 'applic':81C,172C 'attack':48B,134C 'attempt':117C,193C 'bear':151C 'brute':10A,51B,160C 'brute-forc':9A,50B 'candid':145C 'chart':72B,96C,195C,213C 'chartbrew':1A,18B,24B,74C 'check':114C 'cleartext':163C 'configur':198C 'connect':84C 'count':196C 'creat':95C 'cve':12A,15A 'dashboard':3A,19B,27B,58B,101C,127C,141C,186C,210C 'data':73B,93C,214C 'databas':87C 'direct':85C 'effect':42B,116C 'enabl':159C,190C 'even':191C 'expos':168C 'fail':192C 'fix':218C 'forc':52B,161C 'forceabl':11A 'grant':205C 'guess':45B,158C 'host':23B 'log':67B,155C,179C 'must':182C 'obtain':148C 'onlin':157C 'open':78C 'open-sourc':77C 'packag':20B 'paramet':112C 'password':4A,28B,44B,55B,62B,102C,125C,139C,146C,150C,188C,201C,204C 'password-bear':149C 'password-protect':54B,124C,138C 'plaintext':7A,30B,106C 'prior':97C 'protect':56B,71B,126C,140C,189C,209C 'proxi':66B,154C,177C 'public':2A,26B,57B,100C,123C,137C,185C 'queri':36B,111C 'read':60B 'recov':203C 'repeat':143C 'reveal':194C 'rout':131C 'secret':170C 'see':69B 'self':22B 'self-host':21B 'server':64B,152C,175C 'sourc':79C 'storag':128C,164C,173C 'store':5A,25B,104C 'string':37B 'submit':144C 'surfac':121C 'target':135C,181C 'throttl':43B,118C 'transport':167C 'unauthent':47B,133C 'unlimit':156C 'url':35B,110C,166C 'use':91C 'valid':130C 'vulner':120C,216C 'web':80C 'without':115C,199C","nicknames":[],"mitigations":[],"who_affected":"Only deployments of Chartbrew before 5.2.3 that serve public dashboards with password protection enabled are exposed. Instances without public password-protected dashboards, or on 5.2.3 or later, are not affected. Access logs for those dashboards may already contain the password.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chartbrew","dashboards","high","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-68933':14A,17A 'brute':10A 'brute-forc':9A 'chartbrew':1A 'cve':12A,15A 'dashboard':3A 'forceabl':11A 'password':4A 'plaintext':7A 'public':2A 'store':5A","search_b":"'accept':32B 'attack':48B 'brute':51B 'brute-forc':50B 'chart':72B 'chartbrew':18B,24B 'dashboard':19B,27B,58B 'data':73B 'effect':42B 'forc':52B 'guess':45B 'host':23B 'log':67B 'packag':20B 'password':28B,44B,55B,62B 'password-protect':54B 'plaintext':30B 'protect':56B,71B 'proxi':66B 'public':26B,57B 'queri':36B 'read':60B 'see':69B 'self':22B 'self-host':21B 'server':64B 'store':25B 'string':37B 'throttl':43B 'unauthent':47B 'url':35B","search_c":"'5.2.3':99C,220C 'accept':107C 'access':178C,206C 'api':89C 'applic':81C,172C 'attack':134C 'attempt':117C,193C 'bear':151C 'brute':160C 'candid':145C 'chart':96C,195C,213C 'chartbrew':74C 'check':114C 'cleartext':163C 'configur':198C 'connect':84C 'count':196C 'creat':95C 'dashboard':101C,127C,141C,186C,210C 'data':93C,214C 'databas':87C 'direct':85C 'effect':116C 'enabl':159C,190C 'even':191C 'expos':168C 'fail':192C 'fix':218C 'forc':161C 'grant':205C 'guess':158C 'log':155C,179C 'must':182C 'obtain':148C 'onlin':157C 'open':78C 'open-sourc':77C 'paramet':112C 'password':102C,125C,139C,146C,150C,188C,201C,204C 'password-bear':149C 'password-protect':124C,138C 'plaintext':106C 'prior':97C 'protect':126C,140C,189C,209C 'proxi':154C,177C 'public':100C,123C,137C,185C 'queri':111C 'recov':203C 'repeat':143C 'reveal':194C 'rout':131C 'secret':170C 'server':152C,175C 'sourc':79C 'storag':128C,164C,173C 'store':104C 'submit':144C 'surfac':121C 'target':135C,181C 'throttl':118C 'transport':167C 'unauthent':133C 'unlimit':156C 'url':110C,166C 'use':91C 'valid':130C 'vulner':120C,216C 'web':80C 'without':115C,199C","first_public_at":"2026-09-20T02:45:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68933","severity":null,"published_at":"2026-11-06T22:17:59+00:00","modified_at":"2026-11-06T22:17:59+00:00","first_seen_at":"2026-11-06T22:44:32+00:00","fetched_at":"2026-11-06T22:44:32+00:00","note":null}],"documents":[{"id":90780,"url":"https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90782,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-20T02:45:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}