{"id":"CVE-2026-47124","revision":"ae0978d4f77543d4ad631ffaf8846ca5","records":[{"revision":"ae0978d4f77543d4ad631ffaf8846ca5","observedAt":"2026-10-25T12:17:20.277+00:00","statement":{"source":"nvd","id":"CVE-2026-47124","aliases":[],"title":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry …","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.","state":0,"publishedAt":"2026-06-12T22:16:51.25+00:00","modifiedAt":"2026-06-17T10:54:20.623+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47124","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200"],"productCriteria":[],"sourceDates":{"published":"2026-06-12T22:16:51.250","lastModified":"2026-06-17T10:54:20.623"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-47124","identifiers":["CVE-2026-47124"]},"retained":false,"historicalAffected":[]}],"coverage":[]}