CVE-2026-68933

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.

• CWE-307
• CWE-312

• https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6
• https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x

Published

Nov 6, 2026

Last Modified

Nov 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-68924MobSF is a mobile application security testing tool used. Pr…4.9
• CVE-2026-68927MobSF is a mobile application security testing tool used. Pr…3
• CVE-2026-68928Acode is a powerful text and code editor for Android. From 1…8.6
• CVE-2026-68929FastGPT is an open-source LLM platform for building AI appli…9.3
• CVE-2026-6893A flaw was found in dracut. A remote attacker on the adjacen…7.5
• CVE-2026-68930Russh is a Rust SSH client & server library. Prior to 0.62.5…6.5
• CVE-2026-68935Chartbrew is an open-source web application for creating cha…9.1
• CVE-2026-68939Pyenv provides simple Python version management. Prior to 2.…2
• CVE-2026-68941Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-68942Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-68943Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-68944Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…