← Vulnerability feed

Vulnerability record · CVE-2026-30232 · published 10 April 2026

CVE-2026-30232: Depomo chartbrew server-side request forgery (ssrf) vulnerability

Depomo · Chartbrew

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

7.8 CVSS 4.0 High EPSS 0.40% · top 68.5% CWE-918 · Server-side request forgery (SSRF)
7.8CVSS 4.0 base score
0.40%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/chartbrew/chartbrew/commit/9c4a7e2b02acb25f0782bd4ac1f16407d59c2df1 Patch
https://github.com/chartbrew/chartbrew/security/advisories/GHSA-p4rg-967r-w4cv Vendor Advisory

Track CVE-2026-30232 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-27005Depomo chartbrew sql injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.3…EPSS 0.71%8.8CVE-2026-25888Depomo chartbrew code injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.91%8.7CVE-2026-27603Depomo chartbrew missing authentication for critical function vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4…EPSS 0.48%7.7CVE-2026-32252Depomo chartbrew improper authorization vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a cros…EPSS 0.40%7.2CVE-2026-25887Depomo chartbrew code injection vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.92%6.5CVE-2026-25877Depomo chartbrew improper access control vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1…EPSS 0.35%5.4CVE-2026-27605Depomo chartbrew cross-site scripting vulnerabilityChartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.4…EPSS 0.31%10.0CVE-2026-83548SonicWall SMA1000 pre-auth SSRF via alternate access pathThe SMA1000 Appliance Work Place interface exposes an unintended alternate access path that allows server-side request forgery before authentication.…KEVEPSS 8.8%analysed

Source: NIST National Vulnerability Database (record CVE-2026-30232), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.