CVE-2026-85708

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, Chart share and embed tokens were signed with CB_SECRET, including known or shipped-default values in stock source and repository Docker Compose installs. The vulnerable surface is chart share-token verification and filter-access routes for private charts. An attacker who knows the deployment's CB_SECRET targets a private chart that has been shared at least once so a share-policy row exists, then forges a Chart-subject token for that chart id. The known signing key permits valid Chart tokens, and the filter-access path accepts sequential integer ids without requiring a legitimate share link; token expiry and revocation are ineffective once the secret is known. The condition requires a known or default secret and an existing share-policy row. A bare container where CB_SECRET is undefined is outside this path, and a unique secret excludes it only while the value remains unknown and unpredictable. An unauthenticated attacker can enumerate integer ids and read arbitrary private chart data, including chartData, without possessing a legitimate share link. This issue is fixed in version 5.2.3.

• CWE-347

• https://github.com/chartbrew/chartbrew/commit/07fff78db39e1c073a0301ac382c565268824e09
• https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-3chp-cr6f-hp63
• https://github.com/chartbrew/chartbrew/security/advisories/GHSA-3chp-cr6f-hp63

Published

Nov 6, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85701A vulnerability has been found in ramon-victor freegpt-webui…5.3
• CVE-2026-85702A security vulnerability has been detected in ramon-victor f…7.3
• CVE-2026-85703A flaw has been found in ramon-victor freegpt-webui up to 09…6.5
• CVE-2026-85704A security flaw has been discovered in ramon-victor freegpt-…3.7
• CVE-2026-85705The Location Manager plugin for WordPress is vulnerable to g…7.5
• CVE-2026-85706GitLab has remediated an issue in GitLab CE/EE affecting all…10
• CVE-2026-85709LightRAG provides simple and fast retrieval-augmented genera…5.3
• CVE-2026-8571Insufficient policy enforcement in GPU in Google Chrome on A…8.3
• CVE-2026-85712Chartbrew is an open-source web application that can connect…8.8
• CVE-2026-85714Stirling-PDF is a locally hosted web application that facili…9.1
• CVE-2026-85715ExifReader is a JavaScript Exif information parser. Prior to…7.5
• CVE-2026-85716The AsyncHttpClient (AHC) library allows Java applications t…3.7