CVE-2026-32252

Chartbrew versions prior to 4.9.0 contain a cross-tenant authorization bypass vulnerability in the GET /team/:team_id/template/generate/:project_id endpoint. An authenticated attacker with template-generation permissions in their own team can exploit improper promise handling and missing project ownership validation to access and exfiltrate data from projects belonging to other teams, compromising data confidentiality across tenant boundaries. The vulnerability carries a CVSS score of 7.7 (HIGH) with a network-based attack vector requiring only low complexity and valid user credentials. The lack of user interaction requirement and cross-scope impact indicates that an authenticated attacker can remotely retrieve sensitive project data from victim organizations. The attack requires only standard authentication, making it accessible to any user with legitimate access to the platform. There is no evidence of active exploitation in the wild, with an EPSS score of 0.00029 indicating negligible probability of exploitation attempts. No public exploit code is currently available, and the vulnerability has not gained significant community attention or been added to the Known Exploited Vulnerabilities catalog. However, the straightforward nature of the authorization flaw and availability of the fix in version 4.9.0 suggest timely patching is prudent for all Chartbrew deployments handling sensitive data across multiple organizations.