CVE-2026-111386

4.3 MEDIUMpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-204

Public exploit & PoC references

https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw

All references

https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw
https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

LOWCVE-2026-102587
LOWCVE-2026-103526
MEDIUMCVE-2026-104439PoC
MEDIUMCVE-2026-105664PoC
MEDIUMCVE-2026-107843PoC
MEDIUMCVE-2026-109206PoC
MEDIUMCVE-2026-110310PoC
CRITICALCVE-2026-111235PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.