Description
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.
Published: 2026-11-06
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Unauthorized access to the BullMQ administrative dashboard permitting inspection, retry, or deletion of queued jobs and potential exposure of job payloads and logs
Action: Patch
AI Analysis

Impact

Prior to version 5.2.3, the BullMQ administration dashboard in Chartbrew was mounted without an authentication check. An attacker who can reach the /apps/queues path can view job payloads and logs, and depending on the installed Bull Board version and queue state may retry, delete, or otherwise alter jobs. This compromises confidentiality, integrity, and availability of the queued workload.

Affected Systems

The vulnerability affects deployments of the Chartbrew open‑source web application using the chartbrew:chartbrew product. Any instance that has BullMQ and Redis enabled and exposes the /apps/queues route in the reverse proxy is susceptible. The issue was fixed in Chartbrew version 5.2.3, so earlier releases are affected.

Risk and Exploitability

The CVSS score of 9.3 indicates a high severity. No EPSS or KEV data is available, but the lack of authentication makes exploitation straightforward if the vulnerable route is reachable. Attackers only need network reachability to the /apps/queues endpoint; no privileged credentials are required. Depending on configuration, attacks could lead to data disclosure or disruption of the queue processing. Organizations running earlier Chartbrew releases should treat this as an immediate patching priority.

Generated by OpenCVE AI on November 6, 2026 at 22:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Chartbrew 5.2.3 update which removes the unauthenticated access to the BullMQ dashboard.
  • If a temporary override is necessary, ensure the /apps/queues endpoint is restricted by the reverse proxy to trusted IP ranges or remove the route entirely.
  • Configure the Bull Board dashboard to require authentication so that only authorized users can access queue management functions.
  • Audit job payloads and logs for any unauthorized modification or disclosure after deployment of the fix.

Generated by OpenCVE AI on November 6, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Chartbrew
Chartbrew chartbrew
Vendors & Products Chartbrew
Chartbrew chartbrew

Fri, 06 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
Description Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administration dashboard at /apps/queues. A remote unauthenticated attacker reaches /apps/queues on a Chartbrew instance where Redis and BullMQ are enabled and a reverse proxy does not independently block the route. The dashboard trusted network reachability as authorization and exposed its queue-management interface directly. Redis and BullMQ must be enabled and the route must be reachable. Available actions depend on the installed Bull Board version and queue state, while confidentiality depends on job payload and log contents. An unauthenticated user can inspect exposed job payloads and logs and, when enabled by the installed version and queue state, retry or delete jobs or otherwise alter queue processing, affecting confidentiality, integrity, or availability. This issue is fixed in version 5.2.3.
Title Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Chartbrew Chartbrew
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-11-06T21:10:41.526Z

Reserved: 2026-09-04T19:17:36.246Z

Link: CVE-2026-86005

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-06T21:17:12.117

Modified: 2026-11-06T21:17:12.253

Link: CVE-2026-86005

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T23:45:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function