An incomplete security control in Chartbrew prior to version 5.2.2 allows authenticated users with AI access to perform unauthorized database operations, potentially leading to full system compromise.

The application uses an insufficient blocklist of seven SQL keywords to enforce read-only access in its runQuery function. This flaw permits an authenticated user with access to AI features to bypass restrictions and execute arbitrary, high-impact database functions.

The ability to execute arbitrary database functions poses a severe risk to data integrity and confidentiality. Depending on the underlying database configuration, an attacker could potentially read sensitive information, modify data, escalate privileges, or interact with the host operating system, which warrants the critical severity rating despite the authentication requirement.

Immediate Action: Upgrade Chartbrew to version 5.2.2 or later to apply the necessary logic improvements to the runQuery implementation.

Proactive Monitoring: Review database audit logs for unusual queries or administrative commands originating from the service account used by Chartbrew.

Compensating Controls: Restrict database-level permissions for the service account used by Chartbrew to the absolute minimum required for its function, ensuring it cannot perform destructive operations even if the application layer is bypassed.

Public Exploit Available: Unknown

Given the potential for severe impact, including unauthorized data access and command execution, organizations should prioritize updating to version 5.2.2 immediately. Administrators should also verify that the database service account follows the principle of least privilege to minimize the potential blast radius of this or similar vulnerabilities.