A flaw in the POST /user/invited endpoint of Chartbrew fails to validate an invite token, authentication header, or session. This is a CWE-306 (Improper Authentication) vulnerability that allows an unauthenticated attacker to create a fully active account and obtain a valid JSON Web Token, even when the application is configured with existing users and signup restrictions enabled. The vulnerability permits bypassing the normal registration flow that normally queues new users for verification, resulting in elevation of privileges and potential unauthorized access to protected resources.

Chartbrew chartbrew is affected, specifically versions 4.9.0 and earlier that rely on the unpatched /user/invited endpoint. The fix was released in version 5.0.0, so any deployment running a version older than 5.0.0 is vulnerable.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack can be carried out remotely by sending an HTTP POST request to /user/invited from any network location. Successful exploitation grants a fresh fully‑activated account and a bearer token, enabling direct, authenticated access to the application.