Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-94382

Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

CVSS 4.0 2.3 LOWCVSS 3.1 4.2 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-94382

Published

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-94382

Published

beszel

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "henrygd",
                    "product": "beszel",
                    "defaultStatus": "unaffected",
                    "packageURL": "pkg:golang/github.com/henrygd/beszel",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "versionType": "semver",
                            "lessThan": "0.19.0"
                        },
                        {
                            "version": "0.19.0",
                            "status": "unaffected",
                            "versionType": "semver"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON