Chartbrew, an open‑source web application for building charts from databases and APIs, contains an access‑control flaw in its share‑policy routes. The application authenticates the caller against the project specified in the URL path but ignores the policy_id supplied in the request. An attacker that is authenticated and has permission to a single project can therefore update or delete SharePolicy records that belong to any other project. This ability lets an attacker change visibility settings, password protection, allowed parameters, and expiration options for dashboards that the attacker does not own, effectively leaking data that should be confined to another project.

The vulnerability affects Chartbrew engine versions released up to 4.9.0. The fixed version that includes the proper policy_id verification is 5.0.0, released on the project's GitHub releases page. The issue is specific to the chartbrew:chartbrew product as distributed by the developers.

A CVSS score of 8.1 categorizes this flaw as a high‑severity vulnerability. The EPSS score is not provided, so the exact exploitation probability is unknown, but the required attacker capability is modest: any user who can log in and has project access. Because the flaw permits modification of share settings, an attacker can expose sensitive data or alter dashboard behavior on projects they do not own. The vulnerability is not currently listed in the CISA KEV catalog, suggesting no widespread exploitation has been observed yet. However, the lack of verification of policy_id means the attack path is straightforward for any authenticated user with any project access.