{"affected":[{"product":"chartbrew","source":"CNA: GitHub_M","vendor":"chartbrew","versions":[{"status":"affected","version":"< 5.2.3"}]}],"cveId":"CVE-2026-85712","cwes":["CWE-639"],"description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch continue without confirming that the target project belonged to that team. The vulnerable surface is project routes and related authorization checks that accepted user-controlled project identifiers. An authenticated user who is an owner or admin of their own team submits a victim project id together with the attacker's own team_id in the request body; default self-signup grants the required role on the user's own team. Authorization is evaluated against the attacker-selected team instead of the target project's team, and the update path mass-assigns the request body without a project field allow-list. The attacker needs a valid Chartbrew account, an owner or admin role on their own team, and a victim project identifier; requests without the body team_id trick are rejected. The attacker can re-parent the victim project into their own team, gain full read and write access, expose it publicly, remove password protection, and cause the victim to lose it; the shared delete route also permits cross-tenant deletion. This issue is fixed in version 5.2.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793999249566,"publishedAt":1793999249566,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-6gv3-8wxh-6vfq"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/chartbrew/chartbrew/commit/9db1e57c95014256ef0a7a8a4d60af6e7ade42a5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"}],"remediation":[],"revision":"5a2d4636c2e5cee4d367f7906038693c87658eb9d4120d3fbf56be5004cc82b4","sources":[{"modifiedAt":1793999249566,"name":"CNA: GitHub_M","retrievedAt":1794002945280,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85712"}],"ssvc":null,"status":"published","title":"Chartbrew: Cross-tenant project takeover via body.team_id in /project routes","updatedAt":1794002945280}