CVE-2026-94382
4.2 MEDIUMpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI risk analysis
- Summary
- The vulnerability allows any authenticated user to create or delete alerts on systems they shouldn't have access to, potentially disclosing sensitive information.
- Exploitability
- Exploitation requires an authenticated session but can be complex due to needing correct system IDs.
- Blast radius
- If exploited, it could lead to unauthorized access and disclosure of target system names and metrics.
- Prioritized remediation
- Update to Beszel version 0.19.0 or later to address the vulnerability.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-639
Public exploit & PoC references
- https://github.com/henrygd/beszel
- https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80
- https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409
- https://github.com/henrygd/beszel/releases/tag/v0.19.0
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch
All references
- https://github.com/henrygd/beszel
- https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80
- https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409
- https://github.com/henrygd/beszel/releases/tag/v0.19.0
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch
- https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts
- https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2025-71420PoC
- HIGHCVE-2026-48826PoC
- HIGHCVE-2026-48975PoC
- HIGHCVE-2026-48976PoC
- MEDIUMCVE-2026-52743PoC
- MEDIUMCVE-2026-55179PoC
- MEDIUMCVE-2026-55625PoC
- HIGHCVE-2026-55739PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.