CVE-2026-94382

MediumCVSS 4.2

Published: 21/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 21/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Risk Assessment

An authenticated user can create or delete alerts on systems they are not authorized for and receive notifications disclosing those systems' names and metrics. This can lead to infrastructure information leakage and alert manipulation.

Recommendation

Upgrade Beszel to version 0.19.0 or later. Until then, restrict access to the user-alerts API and monitor unusual alert creation and deletion operations.

Other vulnerabilities in Beszel

CVE-2026-40077Low
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS