Overview
CVE-2026-32252 describes a cross-tenant authorization bypass in Chartbrew before version 4.9.0. In the vulnerable flow, the GET /team/:team_id/template/generate/:project_id handler performs an authorization check but does not tie the supplied project_id to the team_id in the request, allowing an authenticated user with template-generation permissions in their own team to request template data for a project owned by another team. This is a classic Broken Function Level Authorization (BFLEC) pattern that can leak data across tenants when resource ownership is not enforced before returning data. The vulnerability maps to CWE-285: Improper Authorization, where access is granted based on a coarse permission without validating the specific resource relationship. The real-world impact is as an attacker can exfiltrate or view confidential project templates belonging to other tenants by manipulating request parameters.
In Go (Gin) implementations, BFLA manifests when a route handler checks the caller's permissions but fails to validate that the requested resource (the project_id in the path) actually belongs to the caller’s team or tenant. Practically, the handler may proceed to generate or return a template using project_id without confirming ownership, enabling cross-tenant data access even for users who should only access their own tenant's data. Remediation requires enforcing strict ownership checks (verify resource ownership against the path parameter or the authenticated tenant context) prior to returning data, and ideally performing RBAC checks after confirming resource ownership in a single, clear flow. This mirrors the mitigation described for CVE-2026-32252, which fixes the issue in Chartbrew by ensuring ownership is validated before data exposure.
The fix patterns in Go (Gin) involve loading the resource (project) by its ID, validating that its TeamID matches the team_id in the URL (or the authenticated tenant context), and only then performing the authorization check and returning the template data. This ensures that even with a broad permission like updateAny for charts, a user cannot access or generate data for projects outside their own tenant. Implementations should also consider using middleware for tenant scoping and add tests that simulate cross-tenant requests to prevent regressions.
Affected Versions
Chartbrew prior to 4.9.0 (fixed in 4.9.0)
Code Fix Example
Go (Gin) API Security Remediation
package main
import (
"errors"
"net/http"
"github.com/gin-gonic/gin"
)
type Project struct {
ID string
TeamID string
}
var projects = map[string]Project{
"p1": {ID: "p1", TeamID: "t1"},
"p2": {ID: "p2", TeamID: "t2"},
}
func getProject(projectID string) (*Project, error) {
if p, ok := projects[projectID]; ok {
return &p, nil
}
return nil, errors.New("not found")
}
type AuthService struct{}
func (a *AuthService) CheckAccess(r *http.Request, action string, resource string) bool {
// Placeholder for real RBAC checks; in production replace with proper implementation
return true
}
// Vulnerable pattern: checks authorization but does not verify resource ownership
func vulnerableHandler(c *gin.Context) {
teamID := c.Param("team_id")
projectID := c.Param("project_id")
auth := &AuthService{}
if auth.CheckAccess(c.Request, "updateAny", "chart") {
// Vulnerable: no ownership check of projectID against teamID
c.JSON(http.StatusOK, gin.H{
"team_id": teamID,
"project_id": projectID,
"template": "data",
})
return
}
c.Status(http.StatusForbidden)
}
// Fixed pattern: validate ownership before returning data
func fixedHandler(c *gin.Context) {
teamID := c.Param("team_id")
projectID := c.Param("project_id")
prj, err := getProject(projectID)
if err != nil {
c.Status(http.StatusNotFound)
return
}
if prj.TeamID != teamID {
c.Status(http.StatusForbidden)
return
}
auth := &AuthService{}
if !auth.CheckAccess(c.Request, "updateAny", "chart") {
c.Status(http.StatusForbidden)
return
}
c.JSON(http.StatusOK, gin.H{
"team_id": prj.TeamID,
"project_id": prj.ID,
"template": "data",
})
}
func main() {
r := gin.Default()
r.GET("/team/:team_id/template/generate/:project_id", vulnerableHandler)
r.GET("/team/:team_id/template/generate/:project_id/fix", fixedHandler)
r.Run(":8080")
}