Chartbrew CVE-2026-40601: Unauthenticated Data Exposure

The National Vulnerability Database (NVD) reports a critical vulnerability, CVE-2026-40601, in Chartbrew, an open-source web application designed for data visualization. Affecting version 4.9.0, this flaw allows an unauthenticated attacker to trigger a data refresh and retrieve sensitive information from private charts. The issue stems from the POST /api/chart/:chart_id/query endpoint failing to properly verify if a target chart belongs to a public report or if sharing policies permit the operation.

Specifically, the NVD notes that the endpoint only checks team.allowReportRefresh, bypassing crucial authentication and authorization checks. An attacker only needs to know a chart identifier to exploit this, making it a straightforward path to data exfiltration. The CVSS score of 7.5 (High) reflects the severity, with a vector indicating network-based attack, low complexity, no privileges required, and high confidentiality impact.

This vulnerability fundamentally undermines the confidentiality of data managed by Chartbrew instances. Organizations using Chartbrew for internal dashboards or client reporting could inadvertently expose sensitive business metrics, operational data, or even customer information. Defenders need to recognize that this isn’t just a theoretical risk; it’s a direct route for any attacker with basic reconnaissance capabilities to pull private data without authentication.