CVE-2026-94382
mediumBeszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authent…
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/henrygd/beszel disclosure@vulncheck.com
- https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80 disclosure@vulncheck.com
- https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409 disclosure@vulncheck.com
- https://github.com/henrygd/beszel/releases/tag/v0.19.0 disclosure@vulncheck.com
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference... disclosure@vulncheck.com
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch 134c704f-9b21-4f2e-91b3-4a467353bcc0