{"id":"CVE-2026-85712","kind":"vulnerability","aliases":["CVE-2026-85712"],"related":[],"title":"Chartbrew: team check lets a user take over other teams' projects","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch continue without confirming that the target project belonged to that team. The vulnerable surface is project routes and related authorization checks that accepted user-controlled project identifiers. An authenticated user who is an owner or admin of their own team submits a victim project id together with the attacker's own team_id in the request body; default self-signup grants the required role on the user's own team. Authorization is evaluated against the attacker-selected team instead of the target project's team, and the update path mass-assigns the request body without a project field allow-list. The attacker needs a valid Chartbrew account, an owner or admin role on their own team, and a victim project identifier; requests without the body team_id trick are rejected. The attacker can re-parent the victim project into their own team, gain full read and write access, expose it publicly, remove password protection, and cause the victim to lose it; the shared delete route also permits cross-tenant deletion. This issue is fixed in version 5.2.3.","summary":"Chartbrew, a self-hosted chart web app, trusts a team ID sent by the user when checking project permissions. A logged-in user who owns or admins their own team can move, read, change or delete another team's project.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chartbrew","package","self-hosted","web-app"],"not_affected_if":["managed-hosting","signup-disabled"],"how_to_check":"- Check the Chartbrew version in the deployed package or image; `package.json` version below `5.2.3` is affected.\n- Confirm the instance allows self-signup, since default signup gives the owner or admin role needed.","fix":"- Chartbrew: upgrade to `5.2.3`.","status":"open","published_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:30+00:00","updated_at":"2026-11-06T21:46:30+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:30Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: upgrade to `5.2.3`.","reach":"internet","title":"Chartbrew: team check lets a user take over other teams' projects","impact":"high","summary":"Chartbrew, a self-hosted chart web app, trusts a team ID sent by the user when checking project permissions. A logged-in user who owns or admins their own team can move, read, change or delete another team's project.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","self-hosted","web-app"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"attacker takes over another team's project data and deletes it","analyst_note":"","how_to_check":"- Check the Chartbrew version in the deployed package or image; `package.json` version below `5.2.3` is affected.\n- Confirm the instance allows self-signup, since default signup gives the owner or admin role needed.","plain_action":"","needs_analyst":false,"not_affected_if":["managed-hosting","signup-disabled"],"who_is_affected":"Self-hosted Chartbrew instances before 5.2.3 with self-signup enabled are exposed, because any new account can get the owner or admin role on its own team. Hosted or managed setups should confirm the vendor has applied the fix; instances with signup disabled and trusted users only have less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4540,"output_tokens":501,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-85712':14A,17A '5.2.3':93C,294C 'accept':133C 'access':264C 'account':222C 'admin':54B,147C,226C 'allow':214C 'allow-list':213C 'also':282C 'anoth':64B 'api':83C 'app':25B,33B 'applic':75C 'assign':205C 'attack':160C,189C,217C,247C 'attacker-select':188C 'authent':140C 'author':130C,183C 'belong':118C 'bodi':168C,208C,240C 'branch':110C 'caller':102C 'caller-control':101C 'caus':272C 'chang':61B 'chart':31B,90C 'chartbrew':1A,18B,26B,68C,221C 'check':3A,43B,98C,131C 'confirm':113C 'connect':78C 'continu':111C 'control':103C,136C 'creat':89C 'cross':285C 'cross-ten':284C 'cve':12A,15A 'data':87C 'databas':81C 'default':169C 'delet':63B,280C,287C 'direct':79C 'evalu':185C 'expos':265C 'field':212C 'fix':291C 'full':260C 'gain':259C 'grant':173C 'host':22B,30B 'id':37B,105C,156C,164C,242C 'identifi':138C,236C 'instead':192C 'issu':289C 'let':4A,107C 'list':215C 'log':48B 'logged-in':47B 'lose':276C 'mass':204C 'mass-assign':203C 'move':59B 'need':218C 'open':72C 'open-sourc':71C 'own':52B 'owner':145C,224C 'packag':19B 'parent':251C 'password':269C 'path':202C 'permiss':45B,97C 'permit':283C 'prior':91C 'project':11A,44B,67B,96C,117C,126C,137C,155C,196C,211C,235C,254C 'protect':270C 'public':267C 're':250C 're-par':249C 'read':60B,261C 'reject':245C 'relat':129C 'remov':268C 'request':167C,207C,237C 'requir':175C 'role':176C,227C 'rout':127C,281C 'select':190C 'self':21B,29B,171C 'self-host':20B,28B 'self-signup':170C 'sent':38B 'share':95C,279C 'signup':172C 'sourc':73C 'submit':152C 'surfac':124C 'take':7A 'target':116C,195C 'team':2A,10A,36B,57B,65B,104C,121C,151C,163C,182C,191C,198C,231C,241C,258C 'teamowner/teamadmin':109C 'tenant':286C 'togeth':157C 'trick':243C 'trust':34B,99C 'updat':201C 'use':85C 'user':6A,41B,50B,135C,141C,179C 'user-control':134C 'valid':220C 'version':293C 'victim':154C,234C,253C,274C 'vulner':123C 'web':24B,32B,74C 'web-app':23B 'without':112C,209C,238C 'write':263C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Chartbrew instances before 5.2.3 with self-signup enabled are exposed, because any new account can get the owner or admin role on its own team. Hosted or managed setups should confirm the vendor has applied the fix; instances with signup disabled and trusted users only have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chartbrew","high","package","selfhosted","webapp"],"campaign_type":null,"search_a":"'-2026':13A,16A '-85712':14A,17A 'chartbrew':1A 'check':3A 'cve':12A,15A 'let':4A 'project':11A 'take':7A 'team':2A,10A 'user':6A","search_b":"'admin':54B 'anoth':64B 'app':25B,33B 'chang':61B 'chart':31B 'chartbrew':18B,26B 'check':43B 'delet':63B 'host':22B,30B 'id':37B 'log':48B 'logged-in':47B 'move':59B 'own':52B 'packag':19B 'permiss':45B 'project':44B,67B 'read':60B 'self':21B,29B 'self-host':20B,28B 'sent':38B 'team':36B,57B,65B 'trust':34B 'user':41B,50B 'web':24B,32B 'web-app':23B","search_c":"'5.2.3':93C,294C 'accept':133C 'access':264C 'account':222C 'admin':147C,226C 'allow':214C 'allow-list':213C 'also':282C 'api':83C 'applic':75C 'assign':205C 'attack':160C,189C,217C,247C 'attacker-select':188C 'authent':140C 'author':130C,183C 'belong':118C 'bodi':168C,208C,240C 'branch':110C 'caller':102C 'caller-control':101C 'caus':272C 'chart':90C 'chartbrew':68C,221C 'check':98C,131C 'confirm':113C 'connect':78C 'continu':111C 'control':103C,136C 'creat':89C 'cross':285C 'cross-ten':284C 'data':87C 'databas':81C 'default':169C 'delet':280C,287C 'direct':79C 'evalu':185C 'expos':265C 'field':212C 'fix':291C 'full':260C 'gain':259C 'grant':173C 'id':105C,156C,164C,242C 'identifi':138C,236C 'instead':192C 'issu':289C 'let':107C 'list':215C 'lose':276C 'mass':204C 'mass-assign':203C 'need':218C 'open':72C 'open-sourc':71C 'owner':145C,224C 'parent':251C 'password':269C 'path':202C 'permiss':97C 'permit':283C 'prior':91C 'project':96C,117C,126C,137C,155C,196C,211C,235C,254C 'protect':270C 'public':267C 're':250C 're-par':249C 'read':261C 'reject':245C 'relat':129C 'remov':268C 'request':167C,207C,237C 'requir':175C 'role':176C,227C 'rout':127C,281C 'select':190C 'self':171C 'self-signup':170C 'share':95C,279C 'signup':172C 'sourc':73C 'submit':152C 'surfac':124C 'target':116C,195C 'team':104C,121C,151C,163C,182C,191C,198C,231C,241C,258C 'teamowner/teamadmin':109C 'tenant':286C 'togeth':157C 'trick':243C 'trust':99C 'updat':201C 'use':85C 'user':135C,141C,179C 'user-control':134C 'valid':220C 'version':293C 'victim':154C,234C,253C,274C 'vulner':123C 'web':74C 'without':112C,209C,238C 'write':263C","first_public_at":"2026-09-06T05:03:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85712","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85712","severity":null,"published_at":"2026-11-06T21:17:11+00:00","modified_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90349,"url":"https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90351,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-06T05:03:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}