The vulnerability lies in an unauthorized access path that allows any authenticated member of a team to read dashboards of projects they are not granted explicit project‑level permissions for. This access bypasses normal authorization checks and exposes the raw project object, which can contain sensitive data such as stored report passwords. The flaw is a classic example of improper authorization (CWE-284), allowing a low‑privileged user to gain confidentiality information that should be restricted.

The affected product is Chartbrew, the open‑source dashboard platform. Versions prior to the 5.0.0 release, including 4.9.0, contain the flaw. The issue was fixed in Chartbrew version 5.0.0, which removes the obsolete route and enforces proper project‑level checks.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. The attack can be executed by any authenticated user who shares a team with the targeted project, making the exploitable condition fairly common within internal teams. An attacker only needs to know the route pattern, send a request, and then capture the response that contains the sensitive project data.