Chartbrew up to 5.2.2 API Connection Management allowPrivateHost improper authorization

Summaryinfo

A vulnerability has been found in Chartbrew up to 5.2.2 and classified as problematic. This impacts an unknown function of the component API Connection Management. The manipulation of the argument allowPrivateHost leads to improper authorization. This vulnerability is referenced as CVE-2026-68935. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Chartbrew up to 5.2.2. This issue affects an unknown part of the component API Connection Management. The manipulation of the argument allowPrivateHost with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal  allowPrivateHost  field from user input. An authenticated user with permission to manage API connections can enable this field to bypass private and reserved-network destination restrictions. An upgrade migration also enables the override on pre-existing API connections. The per-connection setting takes precedence over  CB_ALLOW_PRIVATE_NETWORK_CALLS , so disabling that instance option does not protect connections with the override enabled. Successful exploitation allows requests to internal HTTP services reachable from the Chartbrew server, potentially disclosing information or triggering unauthorized actions depending on the target service. Recognized cloud metadata endpoints remain separately blocked. This issue is fixed in version 5.2.3.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-68935 since 07/31/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1548.002 according to MITRE ATT&CK.

Upgrading to version 5.2.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Chartbrew

Version

• 5.2.0
• 5.2.1
• 5.2.2

Website

• Product: https://github.com/chartbrew/chartbrew/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion