CVE-2026-85708

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description Chart share and embed tokens are signed using the CB SECRET variable, which may contain known or default values in certain Docker Compose installations. This allows an unauthenticated attacker who knows the CB SECRET to forge a Chart-subject token for private charts that have been shared at least once. The issue exists in the chart share-token verification and filter-access routes, where sequential integer ids are accepted without a legitimate share link. Consequently, an attacker can enumerate these ids to read arbitrary private chart data, such as chartData. Token expiry and revocation mechanisms are ineffective if the secret is compromised.

Recommendations Update to version 5.2.3.