CVE-2026-94382lowCWE-639

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

5Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3

exploitation probability

—

observed exploitation

nono source reports it

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Affected products

henrygd · beszel

References

https://github.com/henrygd/beszel https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80 https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409 https://github.com/henrygd/beszel/releases/tag/v0.19.0 https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts