{"id":"EUVD-2026-36592","enisaUuid":"a40b5d41-3473-3939-8262-c59d09e23ab0","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, nezha\u0027s dashboard supports two user roles: RoleAdmin (Role\u003d\u003d0) and RoleMember (Role\u003d\u003d1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:02:40 PM","dateUpdated":"Jun 13, 2026, 3:38:33 AM","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532\n","aliases":"CVE-2026-46717\nGHSA-w4g9-mxgg-j532\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"10d8cbca-abfc-3e86-b197-fa09587eda99","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"enisaIdVendor":[{"id":"64d0f03b-f3b4-307b-abea-22bbadf18d2d","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"a34ae7d8-bd73-3cb3-af98-134af4f23357","vulnerability":{"id":"CVE-2026-46717","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, nezha\u0027s dashboard supports two user roles: RoleAdmin (Role\u003d\u003d0) and RoleMember (Role\u003d\u003d1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:02:40 PM","dateUpdated":"Jun 13, 2026, 3:38:33 AM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532\n","enisa_id":"EUVD-2026-36592\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 30, 2026, 7:18:34 AM","vulnerabilityProduct":[{"id":"d25b0340-1162-3b15-9ef6-9746b9ab9ded","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"vulnerabilityVendor":[{"id":"3d068a11-0286-35eb-a01f-f79c8000754a","vendor":{"name":"nezhahq"}}]}},{"id":"cc909b84-865c-3557-82f8-6250e6113b12","vulnerability":{"id":"GHSA-w4g9-mxgg-j532","description":"Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification","datePublished":"May 23, 2026, 12:08:04 AM","dateUpdated":"Jun 26, 2026, 9:28:27 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46717\nhttps://github.com/nezhahq/nezha/commit/d06d539d34c143d842b91e2a64326e8c8f9bc405\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36592\n","aliases":"CVE-2026-46717\nGHSA-w4g9-mxgg-j532\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}