CVE-2026-94382
Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
- State
- Published
- Severity
- 2.3 Low
- Published
- Sep 21, 2026
- Updated
- Sep 21, 2026
- Reserved
- Sep 21, 2026
Description
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.2 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
beszelhenrygd |
|
References
- GitHub Security Advisory (GHSA-759g-ch5m-2gch)vendor-advisory
- Patch Commitpatch
- Vulnerable UpsertUserAlerts handler at v0.18.8technical-description
- beszel v0.19.0 Release Notesrelease-notes
- https://github.com/henrygd/beszelproduct
- VulnCheck Advisory: Beszel before 0.19.0 Insecure Direct Object Reference via user-alertsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.