Chartbrew CVE-2026-40600: Cross-Project SharePolicy Manipulation

The National Vulnerability Database has detailed CVE-2026-40600, a high-severity vulnerability (CVSS 8.1) impacting Chartbrew, an open-source web application for data visualization. This flaw, present in version 4.9.0, allows authenticated users with access to a single project to modify or delete SharePolicy records belonging to other projects. The underlying issue is an authorization bypass: the affected routes validate the project ID in the URL path but fail to verify if the policy_id actually belongs to that project.

This vulnerability enables unauthorized manipulation of dashboard sharing rules across projects. An attacker could alter visibility settings, password requirements, allowed parameters, and expiration dates for dashboards they shouldn’t have access to. This is a critical control bypass, as it directly undermines data isolation and access controls within multi-tenant or multi-project Chartbrew deployments. It’s not just about viewing data; it’s about controlling who else can see it and under what conditions.

Chartbrew has patched this issue in version 5.0.0. Defenders using Chartbrew must understand that this isn’t a theoretical risk; it’s a practical attack vector for lateral movement and data exposure between projects, even if the initial compromise is limited to a single project’s credentials. The attacker’s calculus here is clear: leverage a low-privilege credential to gain broader control over data sharing configurations, potentially exposing sensitive dashboards to unintended recipients.