CVE-2026-94382lowCWE-639

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

5Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.3

probabilidad de explotación

—

explotación observada

noninguna fuente lo reporta

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Productos afectados

henrygd · beszel

Referencias

https://github.com/henrygd/beszel https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80 https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409 https://github.com/henrygd/beszel/releases/tag/v0.19.0 https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts