CVE-2026-40603— Chartbrew /api/project/dashboard/:brewName 越权漏洞
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-40603 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Chartbrew: Incorrect Access Control in /api/project/dashboard/:brewName via same-team override
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes a legacy dashboard route that returns a project's report data to any authenticated member of the same team, even when that user does not have access to the specific project. The route bypasses project-level authorization and returns the raw project object. As a result, a low-privileged same-team user can read another project's dashboard data and recover the project's stored report password from the response. This issue has been patched in version 5.0.0.
来源: 美国国家漏洞数据库 NVD
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
访问控制不恰当
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-40603 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-40603 的情报信息
Please 登录 to view more intelligence information
- Release v5.0.0 · chartbrew/chartbrew · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-40603
同批安全公告 · chartbrew · 2026-04-30 · 共 6 条
| CVE-2026-40600 | 8.1 HIGH | Chartbrew 项目分享策略路由访问控制错误漏洞 |
| CVE-2026-40904 | 8.1 HIGH | Chartbrew 数据集及数据请求路由访问控制缺陷漏洞 |
| CVE-2026-40601 | 7.5 HIGH | Chartbrew 团队级刷新开关缺失授权漏洞 |
| CVE-2026-40595 | 7.5 HIGH | Chartbrew 公开图表导出缺少访问控制漏洞 |
| CVE-2026-35514 | 6.5 MEDIUM | Chartbrew 用户注册接口绕过限制漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-40603
暂无评论