Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-32252 is a high-severity Improper Authorization (CWE-285) vulnerability in Depomo Chartbrew. Its CVSS base score is 7.7 (High).
Operationally, ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32252 is a cross-tenant authorization bypass vulnerability in Chartbrew, an open-source web application for connecting to databases and APIs to generate charts from data. Affecting versions prior to 4.9.0, the issue resides in the GET /team/:team_id/template/generate/:project_id endpoint. The handler invokes checkAccess(req, "updateAny", "chart") without awaiting the promise and fails to validate that the supplied project_id belongs to the specified team_id or the caller's team, enabling unauthorized access to project data across tenants. The vulnerability carries a CVSS v3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is associated with CWE-285 (Improper Authorization).
An authenticated attacker with template-generation permissions in their own team can exploit this vulnerability remotely over the network with low complexity and no user interaction. By crafting a request with a victim team's project_id, the attacker bypasses authorization checks due to the una waited promise and missing ownership verification, gaining access to the template model and sensitive project data from another team. This results in high-impact confidentiality violations in a changed scope, potentially exposing proprietary data visualizations or underlying database/API insights.
The vulnerability is addressed in Chartbrew version 4.9.0, as detailed in the GitHub security advisory GHSA-mw4f-cf22-qpcj and the fixing commit bf5919043d3587fcbe76123aaabd9a0a9d1033f1. Security practitioners should upgrade to 4.9.0 or later and review access controls in multi-tenant endpoints to prevent similar issues.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21553
Vulnerability Data
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, "updateAny",…
more
"chart") without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller's team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates that access-control decisions are made and applied to each request before access occurs.
Requires a tamperproof, always-invoked reference monitor that performs authorization checks.
Directly requires enforcement of approved authorizations for every access request, stopping improper or missing checks.
Limits granted privileges so that even a bypassed check affects fewer resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.3 directly mandates and configures the authorization mechanisms (identity/group rights, dynamic access rules, isolation, credential enforcement) that stop CWE-285 exploitation; the bounded remainder is non-authorization exposure vectors such as error messages or observable discrepancies.
Mapping access rights to information classification and business requirements forces correct enforcement of authorization decisions, blocking the incorrect authorization weakness at the policy and implementation stage.
Independent reviewers evaluate whether authorization logic matches policy, thereby reducing the window in which incorrect or missing authorization checks remain in production.
By requiring managers to verify that authorization decisions match policy and to remediate deviations, the control limits the persistence of incorrect or missing authorization checks.
Mandatory review and acceptance testing of changes before deployment reduces the chance that an authorization decision will be implemented incorrectly or will grant unintended rights.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-285, a class-level weakness. Rules are authored against its narrower children: CWE-552.