---
id: CVE-2026-85712
title: 'Chartbrew: Cross-tenant project takeover via body.team_id in /project routes'
summary: >-
  Chartbrew is an open-source web application that can connect directly to
  databases and APIs and use the data to create charts. Prior to 5.2.3, the
  shared project permission check trusted a caller-controlled team_id and let
  the teamOwner/…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-639
vendor: chartbrew
product: chartbrew
affected:
  - chartbrew < 5.2.3
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T21:07:29.566Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-85712'
references:
  - url: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq
    label: >-
      https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq
  - url: >-
      https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5
    label: >-
      https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5
  - url: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
    label: 'https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3'
tags:
  - cve.org
ingestedAt: '2026-11-06T22:04:56.331Z'
epss: 0.00369
epssPercentile: 0.30988
---

## Overview

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch continue without confirming that the target project belonged to that team. The vulnerable surface is project routes and related authorization checks that accepted user-controlled project identifiers. An authenticated user who is an owner or admin of their own team submits a victim project id together with the attacker's own team_id in the request body; default self-signup grants the required role on the user's own team. Authorization is evaluated against the attacker-selected team instead of the target project's team, and the update path mass-assigns the request body without a project field allow-list. The attacker needs a valid Chartbrew account, an owner or admin role on their own team, and a victim project identifier; requests without the body team_id trick are rejected. The attacker can re-parent the victim project into their own team, gain full read and write access, expose it publicly, remove password protection, and cause the victim to lose it; the shared delete route also permits cross-tenant deletion. This issue is fixed in version 5.2.3.

## Affected

- `chartbrew < 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.