https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 02:57:57 +0000 https://cve.radiocsirt.org/vuln/cve-2026-32252 <p><strong>Affected:</strong> chartbrew</p> <p>Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, &#34;updateAny&#34;, &#34;chart&#34;) without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller&#39;s team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.</p> <p><strong>Affected:</strong> chartbrew</p> <p>Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cross-tenant authorization bypass exists in Chartbrew in GET /team/:team_id/template/generate/:project_id. The GET handler calls checkAccess(req, &#34;updateAny&#34;, &#34;chart&#34;) without awaiting the returned promise, and it does not verify that the supplied project_id belongs to req.params.team_id or to the caller&#39;s team. As a result, an authenticated attacker with valid template-generation permissions in their own team can request the template model for a project belonging to another team and receive victim project data. This vulnerability is fixed in 4.9.0.</p> https://cve.radiocsirt.org/vuln/cve-2026-32252