CVE-2026-68933

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description Public dashboard passwords are stored in plaintext and transmitted via a URL query parameter. The system lacks effective attempt throttling, allowing unauthenticated attackers to perform brute force attacks by repeatedly submitting candidate passwords. Additionally, because passwords are sent in the URL and stored in cleartext, they may be exposed in application storage and server or proxy access logs. Even failed authentication attempts reveal the chart count and configuration. A successful password recovery grants full access to the protected dashboard and its associated chart data.

Recommendations Update to version 5.2.3.