{"id":"CVE-2026-85295","aliases":[],"cve":{"records":[{"id":"CVE-2026-85295","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-03T16:37:49.262Z","published":"2026-11-06T21:05:31.286Z","modified":"2026-11-06T21:05:31.286Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-11-06T21:05:31.286Z"}],"references":[{"url":"https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/chartbrew/chartbrew/commit/da8c71f156aaa13fbc7ead15a4726740fef2b3c5","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-1394","description":"CWE-1394: Use of Default Cryptographic Key","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerable surface is session JWT fallback in server/modules/verifyToken.js, verifyUser.js, getUserFromToken.js, and socketManager.js across the API and socket layer. A stock source or repository Docker Compose deployment retains a known, weak, or default CB_SECRET and an attacker submits a forged HS256 token decoding to a target user id. Knowing the symmetric secret lets the attacker create a token that the legacy verification fallback accepts as the target user without that user's password or two-factor authentication. The condition includes stock source and repository Docker Compose installs and any otherwise known or weak CB_SECRET; a bare container where CB_SECRET is undefined is not affected by this fallback path. A forged session impersonates the chosen user across the entire API and socket layer and exercises that user's Chartbrew privileges. This issue is fixed in version 5.2.3.","score":9.8,"severity":"critical","published":"2026-11-06T21:05:31.286Z","modified":"2026-11-06T21:05:31.286Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"chartbrew","name":"chartbrew","platforms":[],"versions":[{"version":"< 5.2.3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-85295"}],"remediation":[],"references":["https://github.com/chartbrew/chartbrew/security/advisories/GHSA-qvv4-r3q6-8797","https://github.com/chartbrew/chartbrew/commit/da8c71f156aaa13fbc7ead15a4726740fef2b3c5","https://github.com/chartbrew/chartbrew/releases/tag/v5.2.3"],"sources":[{"name":"CVE","id":"CVE-2026-85295","modified":"2026-11-06T21:05:31.286Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-85295"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}],"sourceAffected":[],"observedAt":"2026-11-06T22:38:43.573Z","kev":{"status":"not-listed","checkedAt":"2026-11-08T03:05:30.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-06T23:30:41.545Z","attemptedAt":"2026-11-06T23:30:41.545Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T23:30:40.796Z","attemptedAt":"2026-11-06T23:30:40.796Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-06T23:30:41.471Z","attemptedAt":"2026-11-06T23:30:41.471Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T23:30:41.180Z","attemptedAt":"2026-11-06T23:30:41.180Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-118502","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-118502","modified":"Nov 6, 2026, 9:05:31 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T23:30:41.471Z"},{"source":"NVD","id":"CVE-2026-85295","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85295","modified":"2026-11-06T21:17:11.140","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-11-06T23:30:41.545Z"}],"aiSummary":{"text":"Chartbrew versions prior to 5.2.3 are vulnerable to full account takeover via JWTs accepted under default CB_SECRET. An attacker with knowledge of the symmetric secret can create a forged token, impersonating a target user without their password or two-factor authentication. This issue affects stock source and repository Docker Compose installs with a known or weak CB_SECRET.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-06T22:46:05.536Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-85295"}]}}