{"id":"CVE-2026-85726","kind":"vulnerability","aliases":["CVE-2026-85726"],"related":[],"title":"Chartbrew: unauthenticated MongoDB injection leaks collection fields via public charts","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, a date-typed MongoDB variable placed inside a quoted query placeholder was inserted as an unescaped string, unlike the safely escaped or coerced string, number, and Boolean branches. The vulnerable surface is mongoDB-backed public, shareable, or embedded charts processed by date-variable substitution. An unauthenticated user supplies a crafted URL filter to a public, shareable, or embedded MongoDB chart whose query places a date-typed variable in a quoted literal. The crafted date value breaks out of the quoted literal and changes query logic; the chart's returned row count becomes a Boolean oracle for character-by-character field extraction. The chart must be externally reachable and use the vulnerable date-in-quoted-placeholder branch. Extraction is read-only and limited to one queried collection per request, and it requires neither an account nor a known field value. The blind oracle can disclose any field in the queried collection, including secrets the chart does not display. This issue is fixed in version 5.2.3.","summary":"Chartbrew is a web app that builds charts from databases and APIs. Before 5.2.3, a date variable placed inside a quoted MongoDB query was not escaped, so an unauthenticated visitor to a public, shareable or embedded chart can use a crafted URL filter to read any field in the queried collection, one character at a time.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["chartbrew","mongodb","package","self-hosted"],"not_affected_if":["no-mongodb-source","no-public-charts","version-5.2.3-or-later"],"how_to_check":"- Check the Chartbrew version in use; affected versions are those before `5.2.3`.\n- Look for public, shareable or embedded MongoDB charts whose query places a date-typed variable inside a quoted placeholder.","fix":"- Chartbrew: upgrade to `5.2.3`.","status":"open","published_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","triaged_at":"2026-11-06T21:46:38+00:00","updated_at":"2026-11-06T21:46:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-06T21:46:38Z","model":"claude-haiku-5-5","output":{"fix":"- Chartbrew: upgrade to `5.2.3`.","reach":"internet","title":"Chartbrew: unauthenticated MongoDB injection leaks collection fields via public charts","impact":"high","summary":"Chartbrew is a web app that builds charts from databases and APIs. Before 5.2.3, a date variable placed inside a quoted MongoDB query was not escaped, so an unauthenticated visitor to a public, shareable or embedded chart can use a crafted URL filter to read any field in the queried collection, one character at a time.","audience":"businesses","category":"package","nicknames":[],"who_cares":["chartbrew","mongodb","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker reads any field in a MongoDB collection","analyst_note":"","how_to_check":"- Check the Chartbrew version in use; affected versions are those before `5.2.3`.\n- Look for public, shareable or embedded MongoDB charts whose query places a date-typed variable inside a quoted placeholder.\n- unknown for any other check the sources do not state.","plain_action":"","needs_analyst":false,"not_affected_if":["no-public-charts","no-mongodb-source","version-5.2.3-or-later"],"who_is_affected":"Teams that run Chartbrew with MongoDB data sources and expose charts publicly, as a shareable link or in an embed. The flaw needs a chart that is reachable from the internet and uses a date variable inside a quoted query placeholder; Chartbrew instances with no public charts or without MongoDB sources are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4534,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-85726':13A,16A '5.2.3':36B,104C,275C 'account':245C 'api':34B,94C 'app':27B 'applic':86C 'back':140C 'becom':200C 'blind':252C 'boolean':132C,202C 'branch':133C,226C 'break':184C 'build':29B 'chang':191C 'charact':75B,206C,208C 'character-by-charact':205C 'chart':10A,30B,59B,101C,145C,167C,195C,212C,265C 'chartbrew':1A,17B,23B,79C 'coerc':128C 'collect':6A,73B,237C,261C 'connect':89C 'count':199C 'craft':63B,157C,181C 'creat':100C 'cve':11A,14A 'data':98C 'databas':32B,92C 'date':38B,107C,149C,173C,182C,222C 'date-in-quoted-placehold':221C 'date-typ':106C,172C 'date-vari':148C 'direct':90C 'disclos':255C 'display':268C 'embed':58B,144C,165C 'escap':48B,126C 'extern':215C 'extract':210C,227C 'field':7A,69B,209C,249C,257C 'filter':65B,159C 'fix':272C 'host':22B 'includ':262C 'inject':4A 'insert':118C 'insid':41B,112C 'issu':270C 'known':248C 'leak':5A 'limit':233C 'liter':179C,189C 'logic':193C 'mongodb':3A,18B,44B,109C,139C,166C 'mongodb-back':138C 'must':213C 'neither':243C 'number':130C 'one':74B,235C 'open':83C 'open-sourc':82C 'oracl':203C,253C 'packag':19B 'per':238C 'place':40B,111C,170C 'placehold':116C,225C 'prior':102C 'process':146C 'public':9A,55B,141C,162C 'queri':45B,72B,115C,169C,192C,236C,260C 'quot':43B,114C,178C,188C,224C 'reachabl':216C 'read':67B,230C 'read-on':229C 'request':239C 'requir':242C 'return':197C 'row':198C 'safe':125C 'secret':263C 'self':21B 'self-host':20B 'shareabl':56B,142C,163C 'sourc':84C 'string':122C,129C 'substitut':151C 'suppli':155C 'surfac':136C 'time':78B 'type':108C,174C 'unauthent':2A,51B,153C 'unescap':121C 'unlik':123C 'url':64B,158C 'use':61B,96C,218C 'user':154C 'valu':183C,250C 'variabl':39B,110C,150C,175C 'version':274C 'via':8A 'visitor':52B 'vulner':135C,220C 'web':26B,85C 'whose':168C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Chartbrew with MongoDB data sources and expose charts publicly, as a shareable link or in an embed. The flaw needs a chart that is reachable from the internet and uses a date variable inside a quoted query placeholder; Chartbrew instances with no public charts or without MongoDB sources are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["chartbrew","high","mongodb","package","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-85726':13A,16A 'chart':10A 'chartbrew':1A 'collect':6A 'cve':11A,14A 'field':7A 'inject':4A 'leak':5A 'mongodb':3A 'public':9A 'unauthent':2A 'via':8A","search_b":"'5.2.3':36B 'api':34B 'app':27B 'build':29B 'charact':75B 'chart':30B,59B 'chartbrew':17B,23B 'collect':73B 'craft':63B 'databas':32B 'date':38B 'embed':58B 'escap':48B 'field':69B 'filter':65B 'host':22B 'insid':41B 'mongodb':18B,44B 'one':74B 'packag':19B 'place':40B 'public':55B 'queri':45B,72B 'quot':43B 'read':67B 'self':21B 'self-host':20B 'shareabl':56B 'time':78B 'unauthent':51B 'url':64B 'use':61B 'variabl':39B 'visitor':52B 'web':26B","search_c":"'5.2.3':104C,275C 'account':245C 'api':94C 'applic':86C 'back':140C 'becom':200C 'blind':252C 'boolean':132C,202C 'branch':133C,226C 'break':184C 'chang':191C 'charact':206C,208C 'character-by-charact':205C 'chart':101C,145C,167C,195C,212C,265C 'chartbrew':79C 'coerc':128C 'collect':237C,261C 'connect':89C 'count':199C 'craft':157C,181C 'creat':100C 'data':98C 'databas':92C 'date':107C,149C,173C,182C,222C 'date-in-quoted-placehold':221C 'date-typ':106C,172C 'date-vari':148C 'direct':90C 'disclos':255C 'display':268C 'embed':144C,165C 'escap':126C 'extern':215C 'extract':210C,227C 'field':209C,249C,257C 'filter':159C 'fix':272C 'includ':262C 'insert':118C 'insid':112C 'issu':270C 'known':248C 'limit':233C 'liter':179C,189C 'logic':193C 'mongodb':109C,139C,166C 'mongodb-back':138C 'must':213C 'neither':243C 'number':130C 'one':235C 'open':83C 'open-sourc':82C 'oracl':203C,253C 'per':238C 'place':111C,170C 'placehold':116C,225C 'prior':102C 'process':146C 'public':141C,162C 'queri':115C,169C,192C,236C,260C 'quot':114C,178C,188C,224C 'reachabl':216C 'read':230C 'read-on':229C 'request':239C 'requir':242C 'return':197C 'row':198C 'safe':125C 'secret':263C 'shareabl':142C,163C 'sourc':84C 'string':122C,129C 'substitut':151C 'suppli':155C 'surfac':136C 'type':108C,174C 'unauthent':153C 'unescap':121C 'unlik':123C 'url':158C 'use':96C,218C 'user':154C 'valu':183C,250C 'variabl':110C,150C,175C 'version':274C 'vulner':135C,220C 'web':85C 'whose':168C","first_public_at":"2026-09-06T05:05:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85726","severity":null,"published_at":"2026-11-06T21:17:11+00:00","modified_at":"2026-11-06T21:17:11+00:00","first_seen_at":"2026-11-06T21:45:08+00:00","fetched_at":"2026-11-06T21:45:08+00:00","note":null}],"documents":[{"id":90352,"url":"https://github.com/chartbrew/chartbrew/commit/9e30fbd0d4a34033813a22bebb6fa6c9ae784d6b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":90344,"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":90354,"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-mr45-2r9x-cgwf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-06T05:05:35+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}