Chartbrew contains a cross‑tenant authorization bypass in the GET /team/:team_id/template/generate/:project_id endpoint. An authenticated attacker with the template‑generation permission in their own team can request the template for a project that belongs to another team and obtain the full template model, which may include database credentials or other secrets. This flaw is an example of Improper Authorization (CWE‑285).

The vulnerability affects all releases of the open‑source Chartbrew application prior to version 4.9.0. Any deployment running 4.8.x or earlier is vulnerable whenever a user has the ability to generate templates in their own tenant, regardless of the team the target project belongs to.

The CVSS score of 7.7 reflects high severity due to the potential exposure of confidential data. The EPSS score is below 1 %, indicating that automated exploitation is currently unlikely, and the flaw is not listed in the CISA KEV catalog. Based on the description, we infer that the attacker can trigger the vulnerability by sending an HTTP GET request to the vulnerable endpoint while authenticated; the attack requires no elevated privileges or network access beyond normal user rights. Successfully exploiting the bug allows the attacker to read sensitive project data from another tenant.