CVE-2026-32252: Depomo Chartbrew Auth Bypass Vulnerability

CVE-2026-32252 Overview

CVE-2026-32252 is a cross-tenant authorization bypass vulnerability in Chartbrew, an open-source web application used for connecting to databases and APIs to create data visualizations and charts. The vulnerability exists in versions prior to 4.9.0 and allows authenticated attackers to access project data belonging to other teams.

Critical Impact

Authenticated attackers can bypass tenant isolation to access sensitive project data from other teams, potentially exposing confidential business intelligence, database connection details, and chart configurations.

Affected Products

• Depomo Chartbrew versions prior to 4.9.0

Discovery Timeline

• 2026-04-10 - CVE-2026-32252 published to NVD
• 2026-04-14 - Last updated in NVD database

Technical Details for CVE-2026-32252

Vulnerability Analysis

This vulnerability represents a classic authorization bypass flaw (CWE-285: Improper Authorization) in a multi-tenant SaaS application. The flaw occurs in the GET /team/:team_id/template/generate/:project_id endpoint, where the authorization check is improperly implemented. The handler calls checkAccess(req, "updateAny", "chart") but fails to await the returned promise, causing the authorization check to be non-blocking and ineffective.

Furthermore, the endpoint does not validate whether the supplied project_id parameter actually belongs to the team_id specified in the request or to the calling user's team. This allows an authenticated user to request template data for any project by simply manipulating the project_id parameter in the URL.

Root Cause

The root cause is twofold: first, an asynchronous authorization function is called without the await keyword, meaning the code continues execution before the authorization check completes. Second, there is no ownership validation to ensure the requested project belongs to either the specified team or the authenticated user's team. This combination creates a horizontal privilege escalation vulnerability where any authenticated user can access resources belonging to other tenants.

Attack Vector

The attack is network-based and requires low complexity to execute. An authenticated attacker with valid template-generation permissions in their own team can craft requests to the vulnerable endpoint with arbitrary project_id values. By iterating through project IDs or using information gathered through other means, the attacker can retrieve template models and associated project data from victim teams without authorization.

The exploitation flow involves:

1. Authenticating with valid credentials to any team
2. Identifying or guessing project IDs belonging to other teams
3. Sending GET requests to /team/:any_team_id/template/generate/:victim_project_id
4. Receiving victim project data in the response due to the bypassed authorization

Detection Methods for CVE-2026-32252

Indicators of Compromise

• Unusual API requests to /team/*/template/generate/* endpoints with mismatched team and project IDs
• Authenticated users accessing project resources outside their team scope
• Increased error rates or access denied responses followed by successful data retrieval
• Log entries showing sequential project ID enumeration patterns

Detection Strategies

• Implement API request logging that correlates team membership with accessed resources
• Configure web application firewall rules to flag requests where team_id doesn't match the authenticated user's team
• Deploy anomaly detection for users accessing unusually high numbers of distinct project IDs
• Monitor for repeated requests to the template generation endpoint from single users

Monitoring Recommendations

• Enable detailed audit logging for all template generation API endpoints
• Set up alerts for cross-team resource access attempts
• Implement rate limiting on the vulnerable endpoint to slow enumeration attacks
• Review historical access logs for evidence of prior exploitation

How to Mitigate CVE-2026-32252

Immediate Actions Required

• Upgrade Chartbrew to version 4.9.0 or later immediately
• Review access logs for evidence of exploitation prior to patching
• Audit all projects for unauthorized access or data exposure
• Consider rotating sensitive credentials stored in affected projects

Patch Information

The vulnerability is fixed in Chartbrew version 4.9.0. The patch is available through the official commit which properly implements the authorization check by awaiting the promise and adding project ownership validation. For complete details, refer to the GitHub Security Advisory GHSA-mw4f-cf22-qpcj.

Workarounds

• Restrict network access to Chartbrew instances to trusted networks only until patching is possible
• Implement additional reverse proxy rules to validate team-project relationships at the edge
• Temporarily disable the template generation feature if not critically needed
• Deploy web application firewall rules to block requests to the vulnerable endpoint

# Example nginx configuration to restrict access to vulnerable endpoint
location ~ ^/team/([0-9]+)/template/generate/([0-9]+)$ {
    # Temporarily block access to vulnerable endpoint until patch is applied
    deny all;
    return 403;
}