{"id":"CVE-2026-68933","aliases":[],"cve":{"records":[{"id":"CVE-2026-68933","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-31T21:49:24.927Z","published":"2026-11-06T21:13:24.862Z","modified":"2026-11-09T13:30:36.717Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-06T21:13:24.862Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-09T13:30:36.717Z"}],"references":[{"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x","tags":["exploit"],"source":"CISA-ADP"}],"weaknesses":[{"id":"CWE-307","description":"CWE-307: Improper Restriction of Excessive Authentication Attempts","source":"GitHub_M"},{"id":"CWE-312","description":"CWE-312: Cleartext Storage of Sensitive Information","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-09T13:30:11.967664Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.","score":7.5,"severity":"high","published":"2026-11-06T21:13:24.862Z","modified":"2026-11-09T13:30:36.717Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"chartbrew","name":"chartbrew","platforms":[],"versions":[{"version":"< 5.2.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-68933"}],"remediation":[],"references":["https://github.com/chartbrew/chartbrew/security/advisories/GHSA-crwc-vx5f-mh8x","https://github.com/chartbrew/chartbrew/commit/c082bfc932b56e89d443a35263419c2308e949a6","https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"],"sources":[{"name":"CVE","id":"CVE-2026-68933","modified":"2026-11-09T13:30:36.717Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-68933"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"sourceAffected":[],"observedAt":"2026-11-09T13:35:55.943Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:05:34.570Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T23:20:36.410Z","attemptedAt":"2026-11-06T23:20:36.410Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T23:20:36.676Z","attemptedAt":"2026-11-06T23:20:36.676Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T23:20:37.613Z","attemptedAt":"2026-11-06T23:20:37.613Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T23:20:36.496Z","attemptedAt":"2026-11-06T23:20:36.496Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-68933","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68933","modified":"2026-11-06T22:17:59.350","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-06T23:20:36.410Z"},{"source":"ENISA EUVD","id":"EUVD-2026-118508","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118508","modified":"Nov 6, 2026, 9:13:24 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-06T23:20:37.613Z"}],"aiSummary":{"text":"Chartbrew versions prior to 5.2.3 store public dashboard passwords in plaintext and lack rate limiting, allowing unauthenticated attackers to brute force passwords. The vulnerability affects public password-protected dashboards. An attacker can gain access to the protected dashboard and its chart data if the password is recovered.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T22:46:22.236Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-68933"}]}}