Chartbrew is vulnerable to unauthenticated brute force attacks against public password‑protected dashboards because passwords are stored in plaintext, transmitted via the URL, and the validation route lacks any attempt throttling. An attacker can discover dashboard secrets and subsequently access chart configurations and data without authentication, thereby compromising the confidentiality of the hosted dashboards.

All Chartbrew installations running any version prior to 5.2.3 of the Chartbrew open‑source web application are affected, provided the dashboard is publicly accessible and password‑protected.

The CVSS score of 7.5 indicates high severity, and the EPSS score is not available. Because the flaw only requires standard HTTP requests to a public endpoint, it is deemed readily exploitable. It is not listed in the CISA KEV catalogue. An attacker can target a public dashboard URL, repeatedly submit candidate passwords, and gain access once the correct password is found, with no pre‑existing credentials or privilege escalation needed.