CVE-2026-30232

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew allows authenticated users to create API data connections with arbitrary URLs. The server fetches these URLs using request-promise without any IP address validation, enabling Server-Side Request Forgery attacks against internal networks and cloud metadata endpoints. This vulnerability is fixed in 4.8.5.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Apr 10, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-302334.3OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allow CVE-2026-302346.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, an authenticated project member with BCF import permi CVE-2026-302356.5OpenProject is an open-source, web-based project management software. Prior to 17.2.0, this vulnerability occurs due to improper validation CVE-2026-302364.3OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when editing a project budget and planning the labor CVE-2026-302376.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302386.1Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.155, 25.0.88, and 26.0.10, there is CVE-2026-302397.1OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were CVE-2026-30245.4Stored Cross-Site Scripting (XSS) vulnerability in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/configuracion/a CVE-2026-302408.1Budibase is a low code platform for creating internal tools, workflows, and admin panels. In 3.31.5 and earlier, a path traversal vulnerabil CVE-2026-302418.2Mercurius is a GraphQL adapter for Fastify. Prior to version 16.8.0, Mercurius fails to enforce the configured queryDepth limit on GraphQL s CVE-2026-302428.5Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py o CVE-2026-302447.5Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and ex