CVE-2026-85712

Summary

Chartbrew prior to 5.2.3 allowed authenticated team owners/admins to reassign victim projects to their own team by submitting a malicious team_id in the request body, bypassing ownership validation due to mass assignment and flawed authorization checks. This enabled full unauthorized access, public exposure, password removal, or deletion of any project the attacker knew the ID of.

Exploitability

Exploitation requires a valid Chartbrew account with owner or admin privileges on the attacker's own team (granted by default self-signup) and knowledge of a victim project's identifier; no external access or special tools are needed.

Blast radius

Successful exploitation allows attackers to seize control of any shared or private project in the instance, leading to data exposure, unauthorized modifications, or complete loss of projects belonging to other teams.

Detection

Defenders should monitor authentication and project update logs for requests where the authenticated user's team_id does not match the team_id associated with the target project in the database; specifically, look for successful PATCH/PUT requests to /api/projects/:id endpoints where the request body includes a team_id field different from the project's original team and results in ownership transfer.

Prioritized remediation

Upgrade to Chartbrew version 5.2.3 or later, which patches the mass assignment vulnerability and enforces strict ownership validation for project ownership transfers.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.