{"id":"CVE-2026-85712","title":"Chartbrew: Cross-tenant project takeover via body.team_id in /project routes","summary":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-639"],"vendor":"chartbrew","product":"chartbrew","affected":["chartbrew < 5.2.3"],"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T21:07:29.566Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85712","references":[{"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq","label":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq"},{"url":"https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5","label":"https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5"},{"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","label":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"}],"tags":["cve.org"],"ingestedAt":"2026-11-06T22:04:56.331Z","epss":0.00369,"epssPercentile":0.30988,"slug":"CVE-2026-85712","body":"## Overview\n\nChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch continue without confirming that the target project belonged to that team. The vulnerable surface is project routes and related authorization checks that accepted user-controlled project identifiers. An authenticated user who is an owner or admin of their own team submits a victim project id together with the attacker's own team_id in the request body; default self-signup grants the required role on the user's own team. Authorization is evaluated against the attacker-selected team instead of the target project's team, and the update path mass-assigns the request body without a project field allow-list. The attacker needs a valid Chartbrew account, an owner or admin role on their own team, and a victim project identifier; requests without the body team_id trick are rejected. The attacker can re-parent the victim project into their own team, gain full read and write access, expose it publicly, remove password protection, and cause the victim to lose it; the shared delete route also permits cross-tenant deletion. This issue is fixed in version 5.2.3.\n\n## Affected\n\n- `chartbrew < 5.2.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}