Loading story…
Two high-severity vulnerabilities in Chartbrew 4.9.0 allowed authenticated users with access to one project in a team to interfere with resources belonging to other projects in the same team. In CVE-2026-40904, dataset and dataRequest routes relied on team-scoped permission checks instead of confirming that the referenced dataset_id, dataRequest ID, and connection_id belonged to projects the user was authorized to access. That flaw exposed cross-project datasets and data requests to unauthorized read, execute, create, update, and delete actions, and could also enable misuse of victim-side database or API connections.
A second flaw, tracked as CVE-2026-40600, affected Chartbrew's project share policy routes. The application validated the project in the URL path but did not ensure the supplied policy_id was tied to that project, allowing users to update or delete SharePolicy records from other projects. Attackers could therefore change dashboard sharing settings such as visibility, password protection, allowed parameters, and expiration rules across project boundaries. Both issues were fixed in Chartbrew 5.0.0.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The identified access control vulnerabilities affecting dataset, dataRequest, and project share policy routes were fixed in Chartbrew version 5.0.0.
Chartbrew version 4.9.0 was affected by two authorization issues: one allowed low-privileged users to access and manipulate datasets and data requests across other projects in the same team, and another allowed authenticated users to update or delete SharePolicy records tied to different projects. Together, the flaws enabled cross-project data exposure and unauthorized changes to dashboard sharing settings.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery added Nuclei detection coverage for two high-severity access control issues affecting **Langflow** and **Budibase**. One template targets `CVE-2026-21445`, a broken access control flaw in Langflow that can expose sensitive conversation and transaction data to unauthenticated users and allow destructive actions such as message deletion through exposed API endpoints. The detection logic uses the `/api/v1/monitor/messages` endpoint, and automated review notes the vulnerability affects versions before the fixed production release **Langflow 1.7.1**, despite inconsistent versioning in the initial template text. The issue is rated **CVSS 9.1**. A second template was introduced for `CVE-2026-31816`, an **authentication bypass** in Budibase caused by improper regex validation in authorization middleware. The template attempts to detect the flaw by sending a crafted `POST` request to a user search endpoint using a webhook query-parameter pattern that could bypass authorization checks and enable user enumeration. ProjectDiscovery's automated review flagged implementation problems in the draft template, including an undefined variable, incorrect CWE mapping, missing vendor metadata, and weak matchers that could lead to false positives, but the underlying vulnerability was still classified as critical with a **CVSS 9.1** score.
Jun 29, 2026
Apache Superset disclosed **CVE-2026-23981**, an improper authorization vulnerability that allows an authenticated user with permission to update charts to alter dashboards they do not own. The issue affects all Superset versions before **6.0.0** and can be exploited through the REST API by supplying dashboard IDs in a chart update request, effectively linking chart-edit privileges to unauthorized dashboard modification. The flaw was traced to missing write-permission validation in `UpdateChartCommand` for target dashboards included in the request body. Apache said the issue is fixed in **Superset 6.0.0** and credited **Đỗ Thành Đạt** for reporting the bug and **Daniel Gaspar** for developing the remediation.
Jul 30, 2026
Two high-severity path traversal vulnerabilities in **SillyTavern** allow authenticated attackers to access files outside intended chat directories in versions prior to `1.17.0`. **CVE-2026-34522** affects the `/api/chats/import` endpoint and lets an attacker write arbitrary files by injecting traversal sequences into the `character_name` parameter, creating a risk of unauthorized file modification and service disruption. The flaw carries a CVSS v3.1 rating of `AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H`. A second flaw, **CVE-2026-34524**, affects `/api/chats/export` and `/api/chats/delete`, where supplying `avatar_url=".."` can enable arbitrary file read and delete operations within the application's user data root. The issue could expose or destroy sensitive files including **`secrets.json`** and **`settings.json`**, with a CVSS v3.1 vector of `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L`. Both vulnerabilities are classified as **CWE-22 path traversal** issues and were patched in **SillyTavern `1.17.0`**.
Jun 29, 2026