Chartbrew up to 5.2.2 Public Dashboard cleartext storage

Summaryinfo

A vulnerability classified as problematic was found in Chartbrew up to 5.2.2. The affected element is an unknown function of the component Public Dashboard. Such manipulation leads to cleartext storage. This vulnerability is uniquely identified as CVE-2026-68933. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Chartbrew up to 5.2.2. It has been rated as problematic. Affected by this issue is an unknown function of the component Public Dashboard. The manipulation with an unknown input leads to a cleartext storage vulnerability. Using CWE to declare the problem leads to CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Impacted is confidentiality. CVE summarizes:

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-68933 since 07/31/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1555.

Upgrading to version 5.2.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Chartbrew

Version

• 5.2.0
• 5.2.1
• 5.2.2

Website

• Product: https://github.com/chartbrew/chartbrew/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion