CVE-2026-85712

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.3

Description An issue exists in the shared project permission check where the system trusts a caller-controlled team id without verifying if the target project belongs to that team. This occurs within project routes and authorization checks that accept user-controlled project identifiers. An authenticated user with an owner or admin role on their own team can submit a victim project ID along with their own team id in the request body. Because the update path performs mass-assignment of the request body without a project field allow-list, the attacker can re-parent the victim project to their own team. This allows the attacker to gain full read and write access, remove password protection, expose the project publicly, or perform cross-tenant deletion via the shared delete route.

Recommendations Update to version 5.2.3.