CVE-2026-94382lowCWE-639

CVE-2026-94382: low-severity vulnerability in henrygd beszel

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

Published

Follow this CVE+ Monitor beszel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.3%
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
henrygd · beszel
Related CVEs — henrygd beszel

In the same product, most dangerous first.

CVE-2026-27734MEDIUMBeszel Vulnerable to Docker API Path Traversal via Unsanitized Container IDEPSS 0.5%CVE-2026-40077LOWBeszel has an IDOR in hub API endpoints that read system ID from URL parameterEPSS 0.2%