CVE-2026-40601
Published: 30 April 2026
Summary
CVE-2026-40601 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-40601 affects Chartbrew, an open-source web application for connecting to databases and APIs to generate charts from data. In version 4.9.0, the POST /api/chart/:chart_id/query endpoint is exposed without authentication. It only verifies the team.allowReportRefresh setting and fails to check if the target chart belongs to a public report, if the project is public, or if sharing policies permit the operation. This missing authorization logic, tied to CWE-862 (Missing Authorization), carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact.
An unauthenticated attacker who knows a chart identifier can exploit this by sending a POST request to the vulnerable endpoint, triggering a data refresh and retrieving the current data from private charts. Exploitation requires no privileges or user interaction, enabling remote information disclosure over the network with low complexity.
The issue has been addressed in Chartbrew version 5.0.0. Security practitioners should upgrade to this patched release, as detailed in the GitHub security advisory (GHSA-cpr6-mhgm-893w) and release notes (v5.0.0).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26409
Vulnerability details
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query without authentication. The endpoint only checks team.allowReportRefresh and does not verify that…
more
the target chart belongs to a public report, that the project is public, or that sharing policy allows the operation. An unauthenticated attacker who knows a chart identifier can trigger a data refresh and retrieve the current data of private charts. This issue has been patched in version 5.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The missing authorization vulnerability in the public-facing Chartbrew web app's /api/chart/:chart_id/query endpoint directly enables exploitation of a public-facing application to retrieve private data without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 requires the system to enforce approved authorizations for access to resources, directly mitigating the missing authorization checks that allow unauthenticated access to private chart data.
AC-14 explicitly identifies and limits actions permitted without identification or authentication, preventing exposure of the sensitive POST /api/chart/:chart_id/query endpoint to unauthenticated attackers.
AC-6 enforces least privilege, which would restrict the team.allowReportRefresh capability to only authorized contexts and prevent its misuse on private charts.