Vulnerability record · CVE-2026-27603 · published 6 March 2026

CVE-2026-27603: Depomo chartbrew missing authentication for critical function vulnerability

Depomo · Chartbrew

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4, the chart filter endpoint POST /project/:project_id/chart/:chart_id/filter is missing both verifyToken and checkPermissions middleware, allowing unauthenticated users to access chart data from any team/project. This issue has been patched in version 4.8.4.

8.7 CVSS 4.0 High EPSS 0.48% · top 61.5% CWE-306 · Missing authentication for critical function

8.7CVSS 4.0 base score

0.48%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Chartbrew Depomo

References

Link	Tags
https://github.com/chartbrew/chartbrew/releases/tag/v4.8.4	Release Notes
https://github.com/chartbrew/chartbrew/security/advisories/GHSA-9fhr-5vvc-p455	ExploitMitigationVendor Advisory

Track CVE-2026-27603 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-27005Depomo chartbrew sql injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3…EPSS 0.71%6 Mar 2026 8.8CVE-2026-25888Depomo chartbrew code injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.91%6 Mar 2026 7.8CVE-2026-30232Depomo chartbrew server-side request forgery (ssrf) vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartb…EPSS 0.40%10 Apr 2026 7.7CVE-2026-32252Depomo chartbrew improper authorization vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cros…EPSS 0.40%10 Apr 2026 7.2CVE-2026-25887Depomo chartbrew code injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.92%6 Mar 2026 6.5CVE-2026-25877Depomo chartbrew improper access control vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.35%6 Mar 2026 5.4CVE-2026-27605Depomo chartbrew cross-site scripting vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4…EPSS 0.31%6 Mar 2026 8.8CVE-2026-67277MikroTik RouterOS btest missing authentication leaks kernel memory and crashes kernelRouterOS accepts a "related" btest connection before the primary session is authenticated, letting an unauthenticated client start an IPv4 UDP test. …KEVEPSS 1.6%analysed5 Sep 2026

Source: NIST National Vulnerability Database (record CVE-2026-27603), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.