CVE-2026-27603highCWE-306

CVE-2026-27603: high-severity vulnerability in chartbrew

Chartbrew: Unauthenticated Chart Filter Endpoint: POST /project/:project_id/chart/:chart_id/filter missing verifyToken + checkPermissions

Published

Follow this CVE+ Monitor chartbrew

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
chartbrew · chartbrew
Related CVEs — chartbrew

In the same product, most dangerous first.

CVE-2026-25887HIGHChartbrew: Remote Code Execution (RCE) via MongoDB Dataset QueryEPSS 0.9%CVE-2026-25888HIGHChartbrew: Remote Code Execution (RCE) via Vulnerable APIEPSS 0.8%CVE-2026-27005HIGHChartbrew: SQL injection in date-type variable handling (applyMysqlOrPostgresVariables)EPSS 0.6%CVE-2026-61851MEDIUMChartbrew: Incomplete Read-Only Keyword Blocklist in AI runQuery ToolEPSS 0.5%CVE-2026-65980HIGHChartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable SubstitutionEPSS 0.5%CVE-2026-61743MEDIUMChartbrew: DNS Rebinding SSRF Bypass in Outbound Request ValidationEPSS 0.4%