CVE-2026-27603

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.

• CWE-306

• https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4Release Notes
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fhr-5vvc-p455Exploit, Mitigation, Vendor Advisory

Published

Mar 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27598Dagu is a workflow engine with a built-in Web user interface…6.5
• CVE-2026-27599CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a …7.2
• CVE-2026-2760Sandbox escape due to incorrect boundary conditions in the G…10
• CVE-2026-27600HomeBox is a home inventory and organization system. Prior t…4.3
• CVE-2026-27601Underscore.js is a utility-belt library for JavaScript. Prio…5.9
• CVE-2026-27602Modoboa is a mail hosting and management platform. Prior to …7.2
• CVE-2026-27604FOSSBilling is a free, open-source billing and client manage…10
• CVE-2026-27605Chartbrew is an open-source web application that can connect…5.4
• CVE-2026-27606Rollup is a module bundler for JavaScript. Versions prior to…9.8
• CVE-2026-27607RustFS is a distributed object storage system built in Rust.…9.1
• CVE-2026-27608Parse Dashboard is a standalone dashboard for managing Parse…8.1
• CVE-2026-27609Parse Dashboard is a standalone dashboard for managing Parse…6.5