CVE-2026-94382lowCWE-639

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

5Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 2.3

probabilidade de exploração

—

exploração observada

nãonenhuma fonte reporta

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

henrygd · beszel

Referências

https://github.com/henrygd/beszel https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80 https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409 https://github.com/henrygd/beszel/releases/tag/v0.19.0 https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts