CVE-2026-94382
Received Received - Intake

Beszel Alert System IDOR Vulnerability Before 0.19.0

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulnCheck

Description
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94382
EUVD
EUVD-2026-83909

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
henrygd beszel to 0.19.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in Beszel versions before 0.19.0. It affects the POST and DELETE endpoints for /api/beszel/user-alerts. Authenticated users can create or delete alerts for systems they do not have access to by supplying arbitrary system IDs. This allows them to register alert rules and receive notifications that disclose target system names and metrics.

Detection Guidance

Check Beszel versions before 0.19.0 for the vulnerability. Review API logs for POST and DELETE requests to /api/beszel/user-alerts with arbitrary system IDs. Look for unauthorized alert creations or deletions in system notifications.

Impact Analysis

An attacker could exploit this to access sensitive live telemetry data from systems they don't own, including CPU, memory, disk usage, temperature, and GPU metrics. They could also enumerate other tenants' systems, exfiltrate operational data, or spam monitoring systems with repeated alerts disrupting legitimate users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive system data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in confidentiality breaches, unauthorized data disclosure, and failure to implement proper access controls.

Mitigation Strategies

Upgrade Beszel to version 0.19.0 or later. Implement system ownership validation in alert handlers. Restrict API access to authenticated users with proper authorization checks for system IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94382. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart