CVE-2026-35514

MEDIUM 6.5

Unauthenticated Account Registration via /user/invited Bypasses All Signup Restrictions in Chartbrew

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, the endpoint POST /user/invited does not validate any invite token, authentication header, or session. Any unauthenticated attacker can call this endpoint directly to create a fully active account and receive a valid JWT — even when the instance has existing users and signupRestricted is enabled. This bypass is distinct from the normal registration endpoint (POST /user) which enforces signupRestricted and sets active: false pending verification. This issue has been patched in version 5.0.0.

CWE	CWE-306
Vendor	chartbrew
Product	chartbrew
Published	Apr 30, 2026

Stay Ahead of the Next One

Get instant alerts for chartbrew chartbrew

Be the first to know when new medium vulnerabilities affecting chartbrew chartbrew are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

chartbrew / chartbrew

= 4.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/chartbrew/chartbrew/security/advisories/GHSA-g47g-v5cp-j8hp github.com: https://github.com/chartbrew/chartbrew/releases/tag/v5.0.0