---
id: "CVE-2026-85712"
page: "https://infrastack.ai/live/CVE-2026-85712"
kind: "vulnerability"
aliases: ["CVE-2026-85712"]
title: "Chartbrew: team check lets a user take over other teams' projects"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["chartbrew", "package", "self-hosted", "web-app"]
not_affected_if: ["managed-hosting", "signup-disabled"]
published_at: "2026-11-06T21:17:11+00:00"
first_seen_at: "2026-11-06T21:45:08+00:00"
updated_at: "2026-11-06T21:46:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85712", "first_seen_at": "2026-11-06T21:45:08+00:00"}]
exploit_sources: []
---

# Chartbrew: team check lets a user take over other teams' projects

Link for people: https://infrastack.ai/live/CVE-2026-85712 (this .md is for agents)

Chartbrew, a self-hosted chart web app, trusts a team ID sent by the user when checking project permissions. A logged-in user who owns or admins their own team can move, read, change or delete another team's project.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Chartbrew version in the deployed package or image; `package.json` version below `5.2.3` is affected.
- Confirm the instance allows self-signup, since default signup gives the owner or admin role needed.

## Fix

- Chartbrew: upgrade to `5.2.3`.

## Timeline

- 2026-11-06T21:45:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85712

## Documents

- [advisory] Vendor advisory: github.com https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq
- [fix] Patch: github.com https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5
- [fix] Release notes: github.com https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3

## From the sources

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch continue without confirming that the target project belonged to that team. The vulnerable surface is project routes and related authorization checks that accepted user-controlled project identifiers. An authenticated user who is an owner or admin of their own team submits a victim project id together with the attacker's own team_id in the request body; default self-signup grants the required role on the user's own team. Authorization is evaluated against the attacker-selected team instead of the target project's team, and the update path mass-assigns the request body without a project field allow-list. The attacker needs a valid Chartbrew account, an owner or admin role on their own team, and a victim project identifier; requests without the body team_id trick are rejected. The attacker can re-parent the victim project into their own team, gain full read and write access, expose it publicly, remove password protection, and cause the victim to lose it; the shared delete route also permits cross-tenant deletion. This issue is fixed in version 5.2.3.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_