CVE-2026-111386
Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 16, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 15, 2026
Description
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-204 Observable Response Discrepancy
Affected Products
| Product | Versions |
|---|---|
nezhanezhahq |
|
References
- GitHub Security Advisory (GHSA-228w-p4h4-6rvw)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.