{"id":"EUVD-2026-36593","enisaUuid":"9511e35d-7a9d-3f2e-bc76-9686b0749629","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users\u0027 cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:02:50 PM","dateUpdated":"Jun 15, 2026, 5:27:46 PM","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-rxf6-wjh4-jfj6\n","aliases":"CVE-2026-47120\nGHSA-rxf6-wjh4-jfj6\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"34fe7c64-78de-3d47-bce7-32c0baac1bc3","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"enisaIdVendor":[{"id":"1be9a6e3-ae06-3240-974d-2a7800219b49","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"2229cc4d-b1d1-377c-a3dd-b21c275bab01","vulnerability":{"id":"CVE-2026-47120","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users\u0027 cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8.","datePublished":"Jun 12, 2026, 9:02:50 PM","dateUpdated":"Jun 15, 2026, 5:27:46 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-rxf6-wjh4-jfj6\n","enisa_id":"EUVD-2026-36593\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 5, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"c7f29c28-2789-3491-8c0d-4fa5775274e3","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.4.0, \u003c 2.0.8"}],"vulnerabilityVendor":[{"id":"30c62474-1d7b-3878-98df-4184078e2328","vendor":{"name":"nezhahq"}}]}},{"id":"77a79f84-d18a-3c3b-a32b-9a475570315b","vulnerability":{"id":"GHSA-rxf6-wjh4-jfj6","description":"Nezha Monitoring: RoleMember can fire other users\u0027 cron tasks via AlertRule.FailTriggerTasks (no ownership check)","datePublished":"May 23, 2026, 12:08:45 AM","dateUpdated":"Jun 26, 2026, 9:28:31 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-rxf6-wjh4-jfj6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47120\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36593\n","aliases":"CVE-2026-47120\nGHSA-rxf6-wjh4-jfj6\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}